Duży Szef [he/him]@lemmygrad.ml to

GenZedong@lemmygrad.mlEnglish · 1 year ago

(URGENT) Lemmy has an XSS vulnerability in the sidebar - sh.itjust.works

sh.itjust.works

23

(URGENT) Lemmy has an XSS vulnerability in the sidebar - sh.itjust.works

sh.itjust.works

Duży Szef [he/him]@lemmygrad.ml to

GenZedong@lemmygrad.mlEnglish · 1 year ago

lemmy.world is a victim of an XSS attack right now and the hacker simply injected a JavaScript redirection into the sidebar. It appears the Lemmy backend does not escape HTML in the main sidebar. Not sure if this is also true for community sidebars. [https://sh.itjust.works/pictrs/image/707c0f16-3d5c-4888-b865-34228d968ee6.png]

Both lemmy.world and lemmy.blahaj.zone are both down, this issue IS URGENT as this could be why they are both down.

@CriticalResist8@lemmygrad.ml @muad_dibber@lemmygrad.ml @CaptCalhoun@lemmygrad.ml @Farmer_Heck@lemmygrad.ml @felipeforte@lemmygrad.ml @ksynwa@lemmygrad.ml

Chat

CriticalResist8@lemmygrad.ml
link
fedilink
English
arrow-up
10·
1 year ago
Lemmygrad is spared, I don’t know if the patch has been deployed our way yet, but we weren’t hit by the exploit.

also yes I didn’t receive a notif.
- Duży Szef [he/him]@lemmygrad.mlOP
  link
  fedilink
  English
  arrow-up
  5·
  1 year ago
  Well that sucks, I’ll do a comment for notifying you next time.

GenZedong@lemmygrad.ml

genzedong@lemmygrad.ml

You are not logged in. However you can subscribe from another Fediverse account, for example Lemmy or Mastodon. To do this, paste the following into the search field of your instance: !genzedong@lemmygrad.ml

This is a Dengist community in favor of Bashar al-Assad with no information that can lead to the arrest of Hillary Clinton, our fellow liberal and queen. This community is not ironic. We are Marxists-Leninists.

This community is for posts about Marxism and geopolitics (including shitposts to some extent). Serious posts can be posted here or in /c/GenZhou. Reactionary or ultra-leftist cringe posts belong in /c/shitreactionariessay or /c/shitultrassay respectively.

We have a Matrix homeserver and a Matrix space. See this thread for more information. If you believe the server may be down, check the status on status.elara.ws.

Rules:

No bigotry, anti-communism, pro-imperialism or ultra-leftism (anti-AES)
We support indigenous liberation as the primary contradiction in settler colonies like the US, Canada, Australia, New Zealand and Israel
If you post an archived link (excluding archive.org), include the URL of the original article as well
Unless it’s an obvious shitpost, include relevant sources
For articles behind paywalls, try to include the text in the post
Mark all posts containing NSFW images as NSFW (including things like Nazi imagery)

Visibility: Public

This community can be federated to other instances and be posted/commented in by their users.

61 users / day
221 users / week
652 users / month
2.5K users / 6 months
93 local subscribers
4.29K subscribers
3.94K Posts
34.1K Comments
Modlog