Security question: several months ago I emailed someone about an XSS injection vulnerability in the code that they use to sanitise user-generated content. I got back a ‘we take security seriously’ canned reply, then nothing. The vulnerable library still hasn’t been patched.
What’s the next step, in terms of responsible disclosure? Chase them, or publish the vulnerability publicly?
Evil Jim O’Donnell
npub1zd…65pry
2024-12-21 12:49:12 UTC
Author Public Key
npub1zd5zeklyd58zq69lnrhzqj8v9yyd6qjtt4atf6y7qy565rfsswhqj65prySeen on
wss://relay.momostr.pinkPublished at
2024-12-21 12:49:12 UTCEvent JSON
{
"id": "cb93ecc26392e50d9116af6e12b572ae7a6ae81bc2d5a33758b99a466ab7ca6e",
"pubkey": "13682cdbe46d0e2068bf98ee2048ec2908dd024b5d7ab4e89e0129aa0d3083ae",
"created_at": 1734785352,
"kind": 1,
"tags": [
[
"proxy",
"https://mastodon.social/@eatyourgreens/113690892841377671",
"web"
],
[
"proxy",
"https://mastodon.social/users/eatyourgreens/statuses/113690892841377671",
"activitypub"
],
[
"L",
"pink.momostr"
],
[
"l",
"pink.momostr.activitypub:https://mastodon.social/users/eatyourgreens/statuses/113690892841377671",
"pink.momostr"
],
[
"-"
]
],
"content": "Security question: several months ago I emailed someone about an XSS injection vulnerability in the code that they use to sanitise user-generated content. I got back a ‘we take security seriously’ canned reply, then nothing. The vulnerable library still hasn’t been patched. \n\nWhat’s the next step, in terms of responsible disclosure? Chase them, or publish the vulnerability publicly?",
"sig": "6e9b4965b39b93566db04f8e5ac6498c0fc9e026ab7b858fd582c51649aa8d7f4bce9ad189c3e4c242bbc62c0fd58c9441f34aeaafbbf2c69db34a8feb6a16ed"
}