[NotAThrow6397]

Mastodon had to patch their software due to a big CVE with a score of 9.9/10 which allows for arbitrary file execution

https://youtube.com/watch?v=3KCyhltnz7w

[happenstance]

tl;dw: several major vulns were found in mastodon during an audit

Critical:

Tootroot/ Arbitrary file creation through media attachments : "Using carefully crafted media files, attackers can cause Mastodon's media processing code to create arbitrary files at any location. Impact : This allows attackers to create and overwrite any file Mastodon has access to, allowing Denial of Service and arbitrary Remote Code Execution." - (https://github.com/mastodon/mastodon/sec...-3cp5-93fm)

XSS through oEmbed preview cards  - "Using carefully crafted oEmbed data, an attacker can bypass the HTML sanitization performed by Mastodon and include arbitrary HTML in oEmbed preview cards. Impact: This introduces a vector for Cross-site-scripting (XSS) payloads that can be rendered in the user's browser when a preview card for a malicious link is clicked through." - (https://github.com/mastodon/mastodon/sec...-vgcc-73hp)

update your shit and if you dont own the shit push the person who owns the shit to update the shit.

v4.1.2 and prior are vulnerable

[NotAThrow6397]

tl;dw: several major vulns were found in mastodon during an audit

Critical:

Tootroot/ Arbitrary file creation through media attachments : "Using carefully crafted media files, attackers can cause Mastodon's media processing code to create arbitrary files at any location. Impact : This allows attackers to create and overwrite any file Mastodon has access to, allowing Denial of Service and arbitrary Remote Code Execution." - (https://github.com/mastodon/mastodon/sec...-3cp5-93fm)

XSS through oEmbed preview cards  - "Using carefully crafted oEmbed data, an attacker can bypass the HTML sanitization performed by Mastodon and include arbitrary HTML in oEmbed preview cards. Impact: This introduces a vector for Cross-site-scripting (XSS) payloads that can be rendered in the user's browser when a preview card for a malicious link is clicked through." - (https://github.com/mastodon/mastodon/sec...-vgcc-73hp)

update your shit and if you dont own the shit push the person who owns the shit to update the shit.

way better TL;DR thanks :pomhappy:

[joepa]

haha LOL lets all move from Twitter to Mastadon!!!!