CVE-2026-54743
MediumCVSS 6.4Exploitation Probability (EPSS)
Low risk42th percentile - higher than 42% of all known CVEs
Summary
Lemmy-ui before version 0.19.19-beta.1 renders Markdown without sanitization, allowing HTML injection and JavaScript execution in the lemmy-ui origin. An approved member or a remote federated instance can store malicious content, and a viewer who renders it may execute script, potentially exposing the viewer's session and authenticated actions.
Risk Assessment
An attacker can steal a user's session or perform unauthorized actions on their behalf, potentially leading to account and data compromise.
Recommendation
Upgrade lemmy-ui to version 0.19.19-beta.1 or later, which includes the fix.
Other vulnerabilities in Lemmy
See all- CVE-2026-29178High
Lemmy, a link aggregator and forum for the fediverse, is vulnerable to server-side request forgery via a dependency on activitypub_federation. Prior to version 0.19.16, the GET /api/v4/image/{filename} endpoint is vulnerable to unauthenticated SSRF through parameter injection in the file_type query parameter. An attacker can inject arbitrary query parameters into the internal request to pict-rs, including the proxy parameter which causes pict-rs to fetch arbitrary URLs.
- CVE-2026-54741Medium
Lemmy before versions 0.19.19 and 1.0.0-alpha.18 does not check the block list when editing private messages. A blocked sender can still edit old messages that the recipient can see, enabling post-block harassment.
- CVE-2026-54740Medium
Lemmy before versions 0.19.19 and 1.0.0-alpha.18 allows a lower-ranked moderator to remove a higher-ranked moderator by sending a signed ActivityPub Remove activity. The verification does not check moderator rank, enabling a junior moderator to strip senior moderators from the community moderator list.
- CVE-2026-54739Medium
Lemmy before versions 0.19.19 and 1.0.0-beta.1 returns different errors during login depending on whether the username or email exists. A nonexistent account returns 404, while an existing account with a wrong password returns 400. This discrepancy allows an unauthenticated attacker to confirm registered usernames or email addresses.
- CVE-2026-54738Medium
Lemmy before versions 0.19.19 and 1.0.0-beta.1 uses the first X-Forwarded-For value as the client address for rate limiting. The bundled nginx config appends the real client address to a client-supplied value, allowing an attacker to spoof the address and bypass limits on multiple API endpoints.
- CVE-2026-54742Medium
Lemmy, a link aggregator and forum for the fediverse, versions 0.19.18 to 0.19.19 and 1.0.0-alpha.20, allows a community moderator to feature or unfeature posts in other communities via federated CollectionAdd and CollectionRemove activities. Lack of verification that the post belongs to the community enables manipulation of other communities' content.
Original NVD description (English source)
Lemmy is a link aggregator and forum for the fediverse. Prior to lemmy-ui 0.19.19-beta.1, LemmyNet/lemmy-ui renders Markdown in src/shared/markdown.ts for post bodies, comment bodies, private messages, and community and site sidebars through mdToHtml, which returns a raw __html object that Inferno injects without a sanitizer pass. setupMarkdown configures html as false but registers [email protected] with useImageSyntax enabled, so an image targeting video media becomes a video element whose fallback incorporates the image alt text through unescaped string replacement. The html setting does not apply to plugin-generated output, allowing crafted alt text to reach the DOM as live HTML in contexts that do not use mdToHtmlNoImages. An approved member or a remote federated instance can store such content, and a viewer who renders it may execute JavaScript in the lemmy-ui origin, exposing the viewer's session and authenticated actions. The advisory notes that Content Security Policy prevents the described exploit in production, but also states that the tested default self-hosted deployment serves no Content-Security-Policy. This issue is fixed in lemmy-ui version 0.19.19-beta.1.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS