Lemmy introduces arbitrary JavaScript into user sessions when a malicious actor embeds script code into the alt‑text of a markdown image that is rendered as a video element. Because the markdown renderer outputs raw HTML without sanitization and the plugin‑generated content bypasses the html flag, the alt text is injected directly into the DOM. When any user views the compromised post, comment, private message, or sidebar, the script executes with the Lemmy UI origin’s privileges, exposing session cookies and allowing the attacker to perform authenticated actions on behalf of the victim.

The flaw affects LemmyNet’s Lemmy platform, specifically the lemmy‑ui component. Any release prior to 0.19.19‑beta.1 renders post bodies, comment bodies, private messages, and community or site sidebars using mdToHtml, creating the vulnerable injection path. The vulnerability is therefore present in all pre‑0.19.19‑beta.1 distributions of lemmy‑ui and any self‑hosted deployment that has not applied the patch or that omits a Content‑Security‑Policy header.

With a CVSS score of 6.4, the vulnerability is considered moderate in severity. EPSS data is not available, so the current exploitation probability is unclear, but the issue can be triggered remotely via federated instances or by any member with write access to content. The advisory notes that a properly configured CSP can mitigate the impact; however, default self‑hosted configurations do not supply a CSP header, leaving the system exposed until patching or a mitigation is applied.