cross-posted from: https://sh.itjust.works/post/923025

lemmy.world is a victim of an XSS attack right now and the hacker simply injected a JavaScript redirection into the sidebar.

It appears the Lemmy backend does not escape HTML in the main sidebar. Not sure if this is also true for community sidebars.

  • TruckBC@lemmy.caMEnglish
    1·
    1 year ago

    At this point I’m monitoring inter-instance communications channels non stop even though I should be in bed. I will be temporarily removing admins that have not responded to my inquiry to confirm if they have 2FA authentication turned on as initial access appears to have been gained due to lack of 2FA.

    If there’s anything additinal we can do, we will.