CVE-2026-54743

Received Received - Intake

Stored XSS in Lemmy UI via Markdown Image Alt Text

Publication date: 2026-08-19

Last updated on: 2026-08-21

Assigner: GitHub, Inc.

Description

Lemmy is a link aggregator and forum for the fediverse. Prior to lemmy-ui 0.19.19-beta.1, LemmyNet/lemmy-ui renders Markdown in src/shared/markdown.ts for post bodies, comment bodies, private messages, and community and site sidebars through mdToHtml, which returns a raw __html object that Inferno injects without a sanitizer pass. setupMarkdown configures html as false but registers markdown-it-html5-embed@1.0.0 with useImageSyntax enabled, so an image targeting video media becomes a video element whose fallback incorporates the image alt text through unescaped string replacement. The html setting does not apply to plugin-generated output, allowing crafted alt text to reach the DOM as live HTML in contexts that do not use mdToHtmlNoImages. An approved member or a remote federated instance can store such content, and a viewer who renders it may execute JavaScript in the lemmy-ui origin, exposing the viewer's session and authenticated actions. The advisory notes that Content Security Policy prevents the described exploit in production, but also states that the tested default self-hosted deployment serves no Content-Security-Policy. This issue is fixed in lemmy-ui version 0.19.19-beta.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-19

Last Modified

2026-08-21

Generated

2026-09-09

AI Q&A

2026-08-20

EPSS Evaluated

2026-09-07

NVD

CVE-2026-54743

EUVD

EUVD-2026-62848

Affected Vendors & Products

Vendor	Product	Version / Range
lemmy	lemmy-ui	0.19.19-beta.1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

Lemmy versions before 0.19.19-beta.1 improperly sanitize user-provided Markdown content. The application renders Markdown in post bodies, comments, and other areas without proper HTML sanitization. Attackers can inject crafted alt text in images that gets interpreted as live HTML, allowing JavaScript execution in the lemmy-ui origin. This exposes users' sessions and authenticated actions.

Detection Guidance

This vulnerability involves Lemmy-ui versions prior to 0.19.19-beta.1 where Markdown rendering allows crafted alt text to inject live HTML. Check your Lemmy-ui version with: npm list lemmy-ui or grep version package.json. If version is below 0.19.19-beta.1, the system is vulnerable.

Impact Analysis

If you view malicious content on a vulnerable Lemmy instance, an attacker could execute arbitrary JavaScript in your browser within the Lemmy site's context. This could allow theft of your session cookies, perform actions on your behalf, or expose sensitive data. The impact depends on your Lemmy usage and the content you interact with.

Compliance Impact

This vulnerability could lead to unauthorized access to user data, violating GDPR's data protection principles and HIPAA's security requirements for protected health information. The potential for session hijacking and data exposure may result in compliance breaches depending on the data processed by the Lemmy instance.

Mitigation Strategies

Upgrade Lemmy-ui to version 0.19.19-beta.1 or later immediately. If upgrading is not possible, disable Markdown rendering or apply a Content Security Policy header to block inline scripts. Review and sanitize user-generated content, especially alt text in images.

Hi! I’m here to help you understand CVE-2026-54743. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70