Clicking the image isn’t the issue, scrolling by it will nab your Auth tokens. Resetting your password will reset the Auth tokens protecting your account. A sign out everywhere button would fix it but that isn’t an option yet. It really needs to be.

I used Firefox… So I definitely reset my password. Thing is I do not see an option for Lemmy where you can “sign out everywhere” which is the counter to Auth token stealing.

So I had to change it so that the Auth token would expire. Whilst I am not an admin I won’t take the chance. It could compromise other users and I do not want to take that risk.

That’s even worse, if Lemmy has a vulnerability like that it needs to get fixed ASAP… Also if that code actually works, I am going to have to secure my account.

Some information I have posted to Lemmy.World:

I am not a super code-literate person so bare with me on this… But. Still please becareful. There appears to be a vulnerability.

Users are posting images like the following:

https://imgur.com/a/RS4iAeI

And inside hidden is JavaScript code that when executed can take cookie information and send it to a URL address.

Among other things. At this time if you see an image please click the icon circled before clicking the link. DO NOT CLICK THE IMAGE. If you see anything suspicious, please report it immediately. It is better a false report than a missed one.

I have seen multiple posts by these people during the attack. It is most certainly related to JS.

They serve people in the EU so they absolutely have to comply. If you have EU citizens on your website then EU GDPR regulations apply to you.

I have done enough GDPR compliance training to make me want to gouge my own brain out but I guess it came in handy lol

Then they are in breach of GDPR regulations. If they don’t comply I could see some serious fines heading their way

As a European it is an option for me

They really scared about Lemmy? Being so blatant about this shit… I have learned the following:

• They do not like subreddits going NSFW it makes them no money. I for one welcome all furries and rule 34 artwork to Reddit.

• They do not like people promoting Lemmy, any kind of competition gets them trying every tactic they can muster, playing all their cards now.

• They do not like people deleting or removing data from Reddit. You know what would suck? A GDPR deletion request… That would be a real damn shame. No data to sell then lol

This is the way, we did it… - u/spez