CVE-2026-54743: Lemmy UI Markdown XSS Vulnerability

CVE-2026-54743 Overview

CVE-2026-54743 is a stored cross-site scripting (XSS) vulnerability in Lemmy-UI, the web frontend for the Lemmy federated link aggregator and forum platform. The flaw affects src/shared/markdown.ts in versions prior to 0.19.19-beta.1. Lemmy-UI renders Markdown through mdToHtml, which returns a raw __html object that Inferno injects without sanitization. The markdown-it-html5-embed@1.0.0 plugin bypasses the html: false setting by incorporating unescaped image alt text into generated video fallback elements. An approved member or remote federated instance can store crafted content that executes JavaScript in the lemmy-ui origin when viewed [CWE-79].

Critical Impact
A viewer rendering malicious federated content may leak session credentials and trigger authenticated actions in the lemmy-ui origin. Content Security Policy mitigates the exploit, but the tested default self-hosted deployment serves no CSP header.

Affected Products

LemmyNet lemmy-ui versions prior to 0.19.19-beta.1
Self-hosted Lemmy instances using the default deployment configuration without a Content-Security-Policy header
Federated Lemmy instances receiving crafted posts, comments, private messages, or sidebars from remote peers

Discovery Timeline

2026-08-19 - CVE-2026-54743 published to NVD
2026-08-19 - Last updated in NVD database

Technical Details for CVE-2026-54743

Vulnerability Analysis

Lemmy-UI renders user-supplied Markdown for post bodies, comment bodies, private messages, and community and site sidebars. The mdToHtml function returns a raw __html payload that Inferno inserts into the DOM without any sanitizer pass. Contexts using mdToHtmlNoImages are not affected, but all other rendering paths propagate the untrusted output directly to the browser.

An approved member on the local instance or any remote federated instance can store the malicious payload. When any viewer loads the content, the injected script executes in the origin of the Lemmy-UI application, exposing session tokens and enabling authenticated actions on behalf of the victim.

Root Cause

The setupMarkdown routine configures the markdown-it parser with html: false, which normally blocks raw HTML input. However, the setting does not apply to output produced by plugins. The registered markdown-it-html5-embed@1.0.0 plugin runs with useImageSyntax enabled, so an image reference whose target is a video media type is rewritten into a <video> element. The fallback content of that element is assembled through unescaped string replacement using the image alt text, letting attacker-controlled markup reach the DOM as live HTML.

Attack Vector

An attacker with the ability to post content, including a remote federated actor, crafts Markdown image syntax pointing at a video media type and embeds HTML in the alt text field. The generated <video> fallback carries the raw alt text into the rendered page. When a victim navigates to the containing post, comment, message, or sidebar, the browser executes the injected script in the Lemmy-UI origin.

typescript

// Security patch in src/shared/markdown.ts
// [0.19] Swap library for markdown media embeds (#4213)
 // import markdown_it_emoji from "markdown-it-emoji/bare";
 import markdown_it_bidi from "markdown-it-bidi";
 import markdown_it_footnote from "markdown-it-footnote";
-import markdown_it_html5_embed from "markdown-it-html5-embed";
+import { html5Media } from "markdown-it-html5-media";
 import markdown_it_ruby from "markdown-it-ruby";
 import markdown_it_sub from "markdown-it-sub";
 import markdown_it_sup from "markdown-it-sup";

Source: GitHub Commit 81a3fe0. The fix replaces markdown-it-html5-embed with markdown-it-html5-media, which does not interpolate raw alt text into HTML output.

Detection Methods for CVE-2026-54743

Indicators of Compromise

Markdown image references whose URL targets a video MIME type combined with alt text containing HTML tags such as <script>, <img onerror=, or event handler attributes
Rendered <video> elements in stored content whose fallback text contains executable markup rather than plain descriptive text
Federated activities delivering posts, comments, or sidebar content with unusual image alt-text payloads from remote instances

Detection Strategies

Scan the Lemmy database for stored post, comment, private_message, community, and site fields containing image Markdown with angle brackets or event handlers inside the alt text.
Inspect outbound and inbound ActivityPub payloads for image references with suspicious alt text arriving from federated peers.
Review browser telemetry for script execution or unexpected fetch/XMLHttpRequest traffic originating from Lemmy-UI page contexts.

Monitoring Recommendations

Enable and monitor Content-Security-Policy violation reports on the Lemmy-UI origin to identify blocked inline script attempts.
Log and alert on new or modified content originating from newly federated instances until reputation is established.
Correlate account activity for viewers who rendered flagged content, watching for session reuse or privileged actions performed shortly after page load.

How to Mitigate CVE-2026-54743

Immediate Actions Required

Upgrade Lemmy-UI to version 0.19.19-beta.1 or later, which replaces markdown-it-html5-embed with markdown-it-html5-media.
Deploy a restrictive Content-Security-Policy header on the Lemmy-UI origin that blocks inline scripts and untrusted script sources.
Audit stored content and federated inbox items for pre-existing payloads matching the vulnerable pattern and remove them.

Patch Information

The issue is fixed in lemmy-ui 0.19.19-beta.1. Refer to the GitHub Security Advisory GHSA-2g66-9fr3-ppwj, the remediation Pull Request #4213, and the Release Tag 0.19.19-beta.1 for full details.

Workarounds

Configure a strong Content-Security-Policy header at the reverse proxy that disallows unsafe-inline script execution, which prevents the described exploit even on unpatched versions.
Restrict federation to trusted instances and require manual approval for new registrations until the upgrade is applied.
Temporarily disable rendering of image Markdown in contexts that do not use mdToHtmlNoImages if a rapid patch cycle is not possible.

bash

# Example nginx Content-Security-Policy header for Lemmy-UI
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'; media-src 'self' https:; img-src 'self' data: https:;" always;