Youāre right but then that means only a compromised admin account can do that (and that is the case on lemmy.world with Michelleās account). The thing is it happened on other instances too, so Iām very inclined to think that thereās also something going on with comments or community sidebars.
AlmightySnoo II š¢
- 0 Followers
- 0 Following
- 0 Posts
when you see this huge thing, RUN FOR YOUR LIVES:
thatās the compromised custom emoji
See the edit on the original thread, itās apparently the tagline (where a message can be shown above the main feed).
what I find curious is how the quotes got in there without being escaped, I kept trying to reproduce that with comments and I couldnāt
Iām wrong sorry, Firefox inspector deceived me but when you look at the HTML itās indeed escaped, I definitely need to go to sleep
see my edit on the comment you just responded to, I just injected an āalertā
wow youāre right, so itās not just sidebars, itās the whole Markdown parser:
yeah an admin account was compromised, but the sidebar vulnerability is serious too, just imagine if the community sidebars have this problem too
Have you tried sending the API request for the sidebar edit yourself? Maybe the escaping is only done at the UI level (which would be EXTREMELY bad).