GenZedongEnglish · 1 year ago

(URGENT) Lemmy has an XSS vulnerability in the sidebar - sh.itjust.works

sh.itjust.works

(URGENT) Lemmy has an XSS vulnerability in the sidebar - sh.itjust.works

sh.itjust.works

Duży Szef [he/him] to

GenZedongEnglish · 1 year ago

lemmy.world is a victim of an XSS attack right now and the hacker simply injected a JavaScript redirection into the sidebar. It appears the Lemmy backend does not escape HTML in the main sidebar. Not sure if this is also true for community sidebars. [https://sh.itjust.works/pictrs/image/707c0f16-3d5c-4888-b865-34228d968ee6.png]

Both lemmy.world and lemmy.blahaj.zone are both down, this issue IS URGENT as this could be why they are both down.

@CriticalResist8@lemmygrad.ml @muad_dibber@lemmygrad.ml @CaptCalhoun@lemmygrad.ml @Farmer_Heck@lemmygrad.ml @felipeforte@lemmygrad.ml @ksynwa@lemmygrad.ml

Chat

Duży Szef [he/him]OP
link
fedilink
English
arrow-up
5·
1 year ago
Well that sucks, I’ll do a comment for notifying you next time.

GenZedong

genzedong

Create a post

You are not logged in. However you can subscribe from another Fediverse account, for example Lemmy or Mastodon. To do this, paste the following into the search field of your instance: !genzedong@lemmygrad.ml

This is a Dengist community in favor of Bashar al-Assad with no information that can lead to the arrest of Hillary Clinton, our fellow liberal and queen. This community is not ironic. We are Marxists-Leninists.

This community is for posts about Marxism and geopolitics (including shitposts to some extent). Serious posts can be posted here or in /c/GenZhou. Reactionary or ultra-leftist cringe posts belong in /c/shitreactionariessay or /c/shitultrassay respectively.

We have a Matrix homeserver and a Matrix space. See this thread for more information. If you believe the server may be down, check the status on status.elara.ws.

Rules:

No bigotry, anti-communism, pro-imperialism or ultra-leftism (anti-AES)
We support indigenous liberation as the primary contradiction in settler colonies like the US, Canada, Australia, New Zealand and Israel
If you post an archived link (excluding archive.org), include the URL of the original article as well
Unless it’s an obvious shitpost, include relevant sources
For articles behind paywalls, try to include the text in the post
Mark all posts containing NSFW images as NSFW (including things like Nazi imagery)

Visibility: Public

This community can be federated to other instances and be posted/commented in by their users.

78 users / day
231 users / week
683 users / month
1.84K users / 6 months
3.03K local subscribers
4.28K subscribers
8.25K Posts
73.9K Comments
Modlog