News for hackers. Stuff that matters.

A comment on We pwned X, Vercel, Cursor, and Discord through a supply-chain attack. Parent comment

Re:We pwned X, Vercel, Cursor, and Discord through a supply-... by fainpul on Thursday December 18, 2025 @03:15PM (#46318048)
"The script doesn't run unless the file is directly opened (you can't run scripts from (<img src="/image.svg">)."
[ Parent | on HN ]
Re:We pwned X, Vercel, Cursor, and Discord through a supply-... by kevin_thibedeau on Thursday December 18, 2025 @06:01PM (#46320021)
It will run if its in an <object> tag.
[ Parent | on HN ]
Re:We pwned X, Vercel, Cursor, and Discord through a supply-... by amonith on Friday December 19, 2025 @01:22AM (#46322804)
So if you're directly embedding the thing. This is a somewhat rare use case, should not be banned almost anywhere...
[ Parent | on HN ]