CVE-2026-54743

Name of the Vulnerable Software and Affected Versions lemmy-ui versions prior to 0.19.19-beta.1

Description lemmy-ui renders Markdown for post bodies, comment bodies, private messages, and community and site sidebars through the mdToHtml function in src/shared/markdown.ts. This function returns a raw html object that is injected by Inferno without a sanitizer pass. Although setupMarkdown configures html as false, the use of markdown-it-html5-embed@1.0.0 with useImageSyntax enabled allows images targeting video media to become video elements. The fallback for these elements incorporates image alt text through unescaped string replacement. Because the html setting does not apply to plugin-generated output, crafted alt text can reach the DOM as live HTML in contexts not using mdToHtmlNoImages. This allows an approved member or a remote federated instance to store content that enables JavaScript execution in the lemmy-ui origin, potentially exposing the viewer's session and authenticated actions. While Content Security Policy (CSP) prevents this in production, default self-hosted deployments may not serve a CSP.

Recommendations Update lemmy-ui to version 0.19.19-beta.1.