FYI!!! In case you start getting re-directed to porn sites.
Maybe the admin got hacked?
edit: lemmy.blahaj.zone has also been hacked. beehaw.org is also down, possibly intentionally by their admins until the issue is fixed.
Post discussing the point of vulnerability: https://lemmy.ml/post/1896249
Github Issue created here: https://github.com/LemmyNet/lemmy-ui/issues/1895
GitHub PR fixing the bug: https://github.com/LemmyNet/lemmy-ui/pull/1897/files
If your instance has custom emojis defined, this is exploitable everywhere Markdown is available. It is NOT restricted to admins, but can be used to steal an admin’s JWT, which then lets the attacker get into that admin’s account which can then spread the exploit further by putting it somewhere where it’s rendered on every single page and then deface the site.
If your instance doesn’t have any custom emojis, you are safe, the exploit requires custom emojis to trigger the bad code branch.
But won’t custom emojis from remote instances still trigger the exploit?
Apparently the custom emojis are rendered as static images when federated to outside instances so it’s clean.
Compromised in what way? Can you post proof?
image here ![] (https://lemmy.ml/pictrs/image/0332b83a-ab01-4c99-9155-2a08b02fb652.png)
among several others
Could you spoiler that weirdo image
How do you spoiler an image in Lemmy markdown?
It works like this
spoiler test
Test
I can’t get it to work on an image. Is it 4 underscores?
sorry for this being so hectic, I was walking back to my apartment trying to do all this on my phone lol
It’s 3
The image isn’t spoilered? lmao
I wasnt trying to spoiler that image
Are you on an app? It’s this symbol on lemmy
Looks like this if you need to do it yourself
I don’t think it works on an image?!
Works like thistesting spoiling an image
Just go to https://lemmy.world and see for yourself, although be careful it’s nasty.
As of now it looks like this:
And then it randomly redirects to gore sites like lemonparty or chaturbate or some pedo shit. It’s pretty bad.
Alright thanks
Just go to lemmy.world and see for yourself. (Or don’t actually, might give you a virus or something idk)
Yeah I would like someone to post a screenshot i dont want to leak my ip
Just went there and didn’t immediately see anything out of the ordinary, but then was redirected to Chatroulette, lol yikes
