Comment on We Know 15,579 Websites Are Infected. How Do We Tell Them?
tal@lemmy.today 5 days agoEven here:
github.com/LemmyNet/lemmy-ui/issues/1895
Lemmy instances with custom emojis allow malicious Javascript
nvd.nist.gov/vuln/detail/cve-2026-54743
An approved member or a remote federated instance can store such content, and a viewer who renders it may execute JavaScript in the lemmy-ui origin, exposing the viewer’s session and authenticated actions.