Messages seam to be sanitized. So is the username (even if someone types /me with no arguments.
However, you can use the whisper and mes commands to execute arbitrary JavaScript.
Examples:
(/w and /me are interchangeable here)
/w <script>alert('Hello!');</script>
or
/w <script>document.body.innerHTML='';</script>
Note: there can't be any spaces in the injected code.
threat level
Very low
Messages seam to be sanitized. So is the username (even if someone types
/mewith no arguments.However, you can use the whisper and mes commands to execute arbitrary JavaScript.
Examples:
(
/wand/meare interchangeable here)/w <script>alert('Hello!');</script>or
/w <script>document.body.innerHTML='';</script>Note: there can't be any spaces in the injected code.
threat level
Very low