We have little information currently, but we may at least lock the site down for preemptive safety reasons. There seems to be a serious XSS vulnerability within lemmys code. We have disabled community creation temporarily and are contemplating taking the site down temporarily as well. Please find us below and stay safe, ya’ll.

https://mastodon.world/@lemmynsfw https://matrix.to/#/#lemmynsfw:matrix.org

EDIT: For the time being we have disabled federation, new user sign ups, and community creation.

  • @CrackhappyEnglish
    15•1 year ago

    Good luck. The real problem is that bugs like this in your code that lead to easy XSS script loads like this tend to point to a bigger problem.

    • @gaviOPMEnglish
      22•1 year ago

      I agree. There needs to be an audit of lemmy entire source.

    • Cuck4MaiEnglish
      11•1 year ago

      This is on top of the privacy concerns and huge potential for vote manipulation.

      • @astral_avocadoEnglish
        1•1 year ago

        What are these concerns and are they unique to Lemmy vs other fediverse type software like Mastodon?

  • @DelvianSeekEnglish
    10•1 year ago

    Thanks for the heads up! Sounds serious. Keeping fingers crossed that it will get fixed quickly.

      • @Ian_mEnglish
        2•1 year ago

        Damn. I thought my password of 1234 was solid but you guys took it to the next level with FIVE characters!

    • @antizero99English
      2•1 year ago

      Everyone should be using a password manager like 1password, bitwarden, etc. I personally use 1password after using LastPass for years. I’m not going to debate the merits of each, all that matters is to pick one that works for you and use it.