3 ms·
Lemmy has an XSS vulnerability in the Markdown parser
- xyst 3y agoWhat a blunder. I think even the worst static code analyzers would have caught this. Looking at the code that was injected by an attacker it seems like they were trying to extract user sessions and exfiltrate it. https://programming.dev/post/532566 https://programming.dev/post/532566
- urda 3y agoI found myself asking the same thing: https://news.ycombinator.com/item?id=36662195 https://news.ycombinator.com/item?id=36662195