XSS vulnerability fixed on tchncs?

feddit.de Code-Injection in Lemmy möglich - Feddit

Offenbar ist eine Code Injection mittels JavaScript in den Kommentaren gelungen. Damit können Admin-Cookies gestohlen werden und die Instanz gehört somit den Angreifern. Es wundert mich etwas, hier so gar nichts darüber zu lesen?

Is this also fixed on tchncs? Beehaw went offline to fix it, so I assume this is pretty important.

BTW thank you for hosting this instance!

8 comments

The fix pr has been "merged" into our deployment some hours ago and we luckily dont have custom emojis yet :)
- Thank you so much! :) You are doing so much great work hosting all these services for the community.
- Thank you, Milan.
- Thanks

Was/is there some temporary de-federation with other instances because of this? I've commented on a feddit.de post like 9 hours ago, and its still not visible over there.
- no... hopefully it will sync eventually
- I think feddit.de disabled federation for the time being. https://feddit.de/post/1476819
  
  I see. Thanks for the info.

8 comments