LemmyNet's lemmy-ui prior to version 0.19.19-beta.1 uses markdown-it-html5-embed plugin with useImageSyntax enabled, which allows image alt text to be injected as live HTML without proper sanitization. The html setting does not apply to plugin-generated output, enabling crafted alt text to reach the DOM and execute JavaScript. This XSS vulnerability affects post bodies, comment bodies, private messages, and community and site sidebars. An approved member or remote federated instance can store malicious content, and any viewer rendering it may have their session and authenticated actions exposed. The advisory notes that a Content Security Policy prevents this exploit in production environments, but the default self-hosted deployment lacks CSP. The issue is resolved in lemmy-ui 0.19.19-beta.1.

Successful exploitation allows execution of arbitrary JavaScript in the context of the lemmy-ui origin, potentially exposing viewer sessions and enabling unauthorized authenticated actions. The vulnerability affects users who view maliciously crafted content stored by approved members or remote federated instances. The presence of a Content Security Policy in production mitigates the risk, but default self-hosted deployments without CSP remain vulnerable.

Upgrade lemmy-ui to version 0.19.19-beta.1 or later, where this vulnerability is fixed. Additionally, implement a strict Content Security Policy (CSP) to prevent JavaScript execution from untrusted sources. For default self-hosted deployments, ensure CSP is configured to mitigate this risk until the upgrade is applied. No other specific mitigations are noted in the advisory.