KOKoftaBob·Jul 10, 2023Submission
Possible XSS attack on Lemmy instances
22 points · Open discussionLemmyNet
lemmy-ui
CSS2023–2023
LemmyNet / lemmy-ui
lemmy-ui
The official web app for lemmy.
6Distinct people
6Mentions
0Explicit recommenders
1KGitHub stars
What to know before exploring
What it is
The official web app for lemmy.
GitHub
Where it is used
No documented product use has been verified yet.
What people are saying
No recommendation phrase was found in the indexed comments.
No classified warning is attached to this page. Read the discussions before treating silence as approval.
Also in these discussions
No other repository is repeatedly linked in the same discussions.
This week on Hacker News
Nov 7–Nov 14 UTC · Direct repository links and separately labeled related project stories. Indexed through 11/14/2026, 5:04:57 PM UTC.
No direct repository links were found in the indexed HN discussions over the past seven days. Older discussions are available below.
Mentions over time
HN mentions by day6 dated mentions
Observed mentions: 2023-06-18 22:30:47 UTC to 2023-07-10 09:55:09 UTC.
Counts come from the repository’s dated source evidence. Index cutoff: 2026-11-02 08:16:59 UTC.
View mention counts and date ranges
| Period | Start (UTC) | End (exclusive, UTC) | Mentions | Submissions | Comments |
|---|---|---|---|---|---|
| Jun 18 | 2023-06-18 00:00:00 UTC | 2023-06-19 00:00:00 UTC | 1 | 0 | 1 |
| Jun 19 | 2023-06-19 00:00:00 UTC | 2023-06-20 00:00:00 UTC | 0 | 0 | 0 |
| Jun 20 | 2023-06-20 00:00:00 UTC | 2023-06-21 00:00:00 UTC | 0 | 0 | 0 |
| Jun 21 | 2023-06-21 00:00:00 UTC | 2023-06-22 00:00:00 UTC | 0 | 0 | 0 |
| Jun 22 | 2023-06-22 00:00:00 UTC | 2023-06-23 00:00:00 UTC | 1 | 0 | 1 |
| Jun 23 | 2023-06-23 00:00:00 UTC | 2023-06-24 00:00:00 UTC | 0 | 0 | 0 |
| Jun 24 | 2023-06-24 00:00:00 UTC | 2023-06-25 00:00:00 UTC | 0 | 0 | 0 |
| Jun 25 | 2023-06-25 00:00:00 UTC | 2023-06-26 00:00:00 UTC | 0 | 0 | 0 |
| Jun 26 | 2023-06-26 00:00:00 UTC | 2023-06-27 00:00:00 UTC | 0 | 0 | 0 |
| Jun 27 | 2023-06-27 00:00:00 UTC | 2023-06-28 00:00:00 UTC | 0 | 0 | 0 |
| Jun 28 | 2023-06-28 00:00:00 UTC | 2023-06-29 00:00:00 UTC | 0 | 0 | 0 |
| Jun 29 | 2023-06-29 00:00:00 UTC | 2023-06-30 00:00:00 UTC | 0 | 0 | 0 |
| Jun 30 | 2023-06-30 00:00:00 UTC | 2023-07-01 00:00:00 UTC | 0 | 0 | 0 |
| Jul 1 | 2023-07-01 00:00:00 UTC | 2023-07-02 00:00:00 UTC | 0 | 0 | 0 |
| Jul 2 | 2023-07-02 00:00:00 UTC | 2023-07-03 00:00:00 UTC | 0 | 0 | 0 |
| Jul 3 | 2023-07-03 00:00:00 UTC | 2023-07-04 00:00:00 UTC | 0 | 0 | 0 |
| Jul 4 | 2023-07-04 00:00:00 UTC | 2023-07-05 00:00:00 UTC | 0 | 0 | 0 |
| Jul 5 | 2023-07-05 00:00:00 UTC | 2023-07-06 00:00:00 UTC | 0 | 0 | 0 |
| Jul 6 | 2023-07-06 00:00:00 UTC | 2023-07-07 00:00:00 UTC | 0 | 0 | 0 |
| Jul 7 | 2023-07-07 00:00:00 UTC | 2023-07-08 00:00:00 UTC | 0 | 0 | 0 |
| Jul 8 | 2023-07-08 00:00:00 UTC | 2023-07-09 00:00:00 UTC | 0 | 0 | 0 |
| Jul 9 | 2023-07-09 00:00:00 UTC | 2023-07-10 00:00:00 UTC | 0 | 0 | 0 |
| Jul 10 | 2023-07-10 00:00:00 UTC | 2023-07-11 00:00:00 UTC | 4 | 1 | 3 |
What Hacker News says
6 sourcesThis is an XSS vulnerability that is being actively exploited in the wild. A (not-yet-merged) fix was submitted here: https://github.com/LemmyNet/lemmy-ui/pull/1897
In Lemmy.world (and some others) were hackedFor anyone wondering, this was the fix for the vulnerability that allowed people to gain access: https://github.com/LemmyNet/lemmy-ui/pull/1897/files
In Lemmy.world DefacedLooks like it was due to unsafe processing of custom emoji: https://github.com/LemmyNet/lemmy-ui/pull/1897
In Ask HN: Is Lemmy Suffering an Exploit?Apparently they’re removing it.
https://github.com/LemmyNet/lemmy-ui/issues/1357
In Now Reddit are coming for the individual personal subredditsDuplicated content across multiple sites, different names, lack of canonical sources ( https://developers.google.com/search/docs/crawling-indexing/... ), not exactly SEO friendly urls (.../post/{int} vs .../r/sub/comments/{id}/title_of_post/ ),
As long as those issues persist (and the post title is likely a hard one), Reddit will always have an advantage since it's built to be more SEO friendly.
https://github.com/LemmyNet/lemmy/issues/261
https://github.com/LemmyNet/lemmy-ui/issues/1285
In Update from Lemmy after the Reddit blackout