Injection Flaw in Lemmy UI Vulnerability Affects Lemmy Product

CVE-2026-54743

What is CVE-2026-54743?

Lemmy, a popular link aggregator and forum for the fediverse, is affected by an injection flaw that can lead to JavaScript execution within the lemmy-ui environment. This vulnerability arises from the way lemmy-ui processes Markdown content, where an image targeting video media is incorrectly rendered as a video element, allowing unescaped alt text to reach the DOM without proper sanitization. Although Content Security Policy could mitigate such risks, many self-hosted instances do not have it enabled, placing users at risk of session hijacking through crafted content by approved members or remote federated instances. This issue is resolved in version 0.19.19-beta.1.

References