"The script doesn't run unless the file is directly opened (you can't run script... | Hacker News

Hacker Newsnew | past | comments | ask | show | jobs | submit

		fainpul 61 days ago \| parent \| context \| favorite \| on: We pwned X, Vercel, Cursor, and Discord through a ... "The script doesn't run unless the file is directly opened (you can't run scripts from (<img src="/image.svg">)."

kevin_thibedeau 61 days ago [–]

It will run if its in an <object> tag.

amonith 60 days ago | [–]

So if you're directly embedding the thing. This is a somewhat rare use case, should not be banned almost anywhere...

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact