Lemmy is a link aggregator and forum for the fediverse. The vulnerability is caused by the rendering of Markdown in src/shared/markdown.ts for post bodies, comment bodies, private messages, and community and site sidebars through mdToHtml, which returns a raw __html object that Inferno injects without a sanitizer pass. This allows an approved member or a remote federated instance to store crafted content [truncated]
Lemmy is a link aggregator and forum for the fediverse. Prior to 0.19.19 and 1.0.0-beta.1, Lemmy's login endpoint returns different errors based on whether a username or email address exists. This discrepancy allows an attacker to enumerate valid usernames or email addresses. The issue is addressed in Lemmy versions 0.19.19 and 1.0.0-beta.1. Affected administrators should verify their instance versions an [truncated]
