I tried what another user reported and it worked. I submitted a github issue as the security email seems to be unmonitored based on me trying to contact it (regarding a different issue) for over a week now.
Be careful about links you click in Lemmy, I guess.
Cross-site scripting (XSS) is an exploit where the attacker attaches code onto a legitimate website that will execute when the victim loads the website. That malicious code can be inserted in several ways. Most popularly, it is either added to the end of a url or posted directly onto a page that displays user-generated content. In more technical terms, cross-site scripting is a client-side code injection attack.
https://www.cloudflare.com/learning/security/threats/cross-site-scripting/
Impact
One-click Lemmy account compromise by social engineering users to click your posts URL.
Reproduction
Lemmy does not properly sanitize URI's on posts leading to cross-site scripting. You can see this working in action by clicking the "link" attached to this post on the web client.
To recreate, simply create a new post with the URL field set to: javascript:alert(1)//
Patching
Adding filtering to block javascript: and data: URI's seems like the easiest approach.
While this is a critical issue, it makes me trust the platform even more, thanks to people like you who are committed to improving the security. So thanks for reporting this and hopefully it will be fixed as soon as possible 👌
Patching: Allow only beginning with https:// (and maybe http://) might avoid related issues with any other protocols that the various browsers support?
Agreed, I recommended filtering to only http(s) links in the github issue, I just made this x-post. I don't see a strong reason to let people link to weird things like file: and data:, or deeplink to installed apps on your computer/phone. Filtering the scheme to just http(s) is how Nutomic seems to have fixed it in the backend from what I can tell (I am not a rust dev).