Comment on We Know 15,579 Websites Are Infected. How Do We Tell Them?

xxce2AAb@feddit.dk ⁨1⁩ ⁨day⁩ ago

• tal@lemmy.today ⁨1⁩ ⁨day⁩ ago

  Even here:

  github.com/LemmyNet/lemmy-ui/issues/1895

  Lemmy instances with custom emojis allow malicious Javascript

  nvd.nist.gov/vuln/detail/cve-2026-54743

  An approved member or a remote federated instance can store such content, and a viewer who renders it may execute JavaScript in the lemmy-ui origin, exposing the viewer’s session and authenticated actions.

  source
• oinari@piefed.zip ⁨1⁩ ⁨day⁩ ago

  NoScript has returned to my browser this year

  source

  • tal@lemmy.today ⁨1⁩ ⁨day⁩ ago

    Too much of the Web just doesn’t work with browsers without Javascript on for me to do that these days.

    There was a time when I did browse like that.

    source
  • xxce2AAb@feddit.dk ⁨1⁩ ⁨day⁩ ago

    Wise. Personally, I prefer umatrix since that allows me more fine grained control and has the ability to selectively block other resources or types of requests too, but anything is better than letting every website one visits run reams of arbitrary code.

    source