EUVD-2026-62848Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
PR:L because exploitation requires approved membership or control of a federated server; UI:R because victim must browse to malicious content; S:C with C:H/I:H for session hijacking and authenticated action abuse.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
Lemmy is a link aggregator and forum for the fediverse. Prior to lemmy-ui 0.19.19-beta.1, LemmyNet/lemmy-ui renders Markdown in src/shared/markdown.ts for post bodies, comment bodies, private messages, and community and site sidebars through mdToHtml, which returns a raw __html object that Inferno injects without a sanitizer pass. setupMarkdown configures html as false but registers markdown-it-html5-embed@1.0.0 with useImageSyntax enabled, so an image targeting video media becomes a video element whose fallback incorporates the image alt text through unescaped string replacement. The html setting does not apply to plugin-generated output, allowing crafted alt text to reach the DOM as live HTML in contexts that do not use mdToHtmlNoImages. An approved member or a remote federated instance can store such content, and a viewer who renders it may execute JavaScript in the lemmy-ui origin, exposing the viewer's session and authenticated actions. The advisory notes that Content Security Policy prevents the described exploit in production, but also states that the tested default self-hosted deployment serves no Content-Security-Policy. This issue is fixed in lemmy-ui version 0.19.19-beta.1.
AnalysisAI
Stored cross-site scripting in lemmy-ui prior to 0.19.19-beta.1 allows session hijacking and unauthorized authenticated actions against viewers who render attacker-controlled markdown content. The vulnerable markdown-it-html5-embed@1.0.0 plugin generates video element fallback HTML by inserting image alt text via unescaped string replacement, bypassing the markdown-it html:false safety setting because plugin-generated output is never subject to that guard. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires all of the following: (1) the target lemmy-ui deployment serves no Content-Security-Policy header - the vendor advisory confirms that CSP blocks the exploit, and the default self-hosted configuration does not set this header; (2) the attacker must either hold approved-member status on the target Lemmy instance or control a federated Lemmy instance capable of pushing content to the target; (3) the content must be rendered through the mdToHtml path (post bodies, comment bodies, private messages, community sidebars, site sidebars) - the mdToHtmlNoImages rendering path is not affected; (4) the victim must passively view the rendered content in their browser (UI:P). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N) yields a 6.4 score, which modestly understates real-world risk for unprotected deployments. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who operates a federated Lemmy instance crafts a post containing the markdown image token . The content federates to a target self-hosted Lemmy instance with no CSP header. … |
| Remediation | Upgrade lemmy-ui to version 0.19.19-beta.1 or later, as confirmed by the vendor advisory at https://github.com/LemmyNet/lemmy/security/advisories/GHSA-2g66-9fr3-ppwj and corroborated by the tagged release at https://github.com/LemmyNet/lemmy/releases/tag/0.19.19-beta.1. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Username enumeration in Lemmy's login endpoint allows unauthenticated remote attackers to confirm whether a given userna
Server-side request forgery (SSRF) in Lemmy prior to version 0.19.18 allows authenticated low-privileged users to bypass
Rate limit bypass in Lemmy prior to 0.19.19 and 1.0.0-beta.1 allows unauthenticated remote attackers to circumvent all I
Missing moderator rank authorization in Lemmy's ActivityPub federation layer allows a lower-ranked remote moderator to f
Lemmy is a link aggregator and forum for the fediverse. Rated medium severity (CVSS 6.5), this vulnerability is remotely
Server-side request forgery (SSRF) in Lemmy prior to version 0.19.18 allows authenticated low-privileged users to trigge
Private message block enforcement in Lemmy is bypassed by the edit path, allowing a blocked sender to keep modifying old
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today