Ditto’s bug was arbitrary JavaScript in the app WebView (XSS...

npub1l5sga6xg72phsz5422ykujprejwud075ggrr3z2hwyrfgr7eylqstegx9z

hex

82fc876da0ad524da96baa515ff2db7e74c08a972cc4a5a1797cc687a4fe66c0

nevent

nevent1qqsg9ly8dks265jd4946552l7tdhuaxq32tje39959uhe3585nlxdsqprpmhxue69uhhyetvv9ujuem4d36kwatvw5hx6mm9qgs06gywary09qmcp2249ztwfq3ue8wxhl2yyp3c39thzp55plvj0sg0vljxq

Kind-1 (TextNote)

2026-08-20T05:03:55Z

↳ Reply to Event not found

83b3f18becf5f789f2a2d0623ed39b14d602171a08d206076221e56981e5057c...

Ditto’s bug was arbitrary JavaScript in the app WebView (XSS), not RCE, from which they could drive the app. Including the session keys, but no stealing of the key.

Raw JSON

{
  "kind": 1,
  "id": "82fc876da0ad524da96baa515ff2db7e74c08a972cc4a5a1797cc687a4fe66c0",
  "pubkey": "fd208ee8c8f283780a9552896e4823cc9dc6bfd442063889577106940fd927c1",
  "created_at": 1787202235,
  "tags": [
    [
      "e",
      "59485f834f439305f3bad68a07fd112c30591bb79a41288861feab886adf2db6",
      "wss://nostr.land/",
      "root",
      "0461fcbecc4c3374439932d6b8f11269ccdb7cc973ad7a50ae362db135a474dd"
    ],
    [
      "e",
      "83b3f18becf5f789f2a2d0623ed39b14d602171a08d206076221e56981e5057c",
      "wss://theforest.nostr1.com/",
      "reply",
      "036533caa872376946d4e4fdea4c1a0441eda38ca2d9d9417bb36006cbaabf58"
    ],
    [
      "p",
      "036533caa872376946d4e4fdea4c1a0441eda38ca2d9d9417bb36006cbaabf58"
    ],
    [
      "p",
      "50d94fc2d8580c682b071a542f8b1e31a200b0508bab95a33bef0855df281d63"
    ],
    [
      "p",
      "0461fcbecc4c3374439932d6b8f11269ccdb7cc973ad7a50ae362db135a474dd"
    ],
    [
      "client",
      "imwald"
    ]
  ],
  "content": "Ditto’s bug was arbitrary JavaScript in the app WebView (XSS), not RCE, from which they could drive the app. Including the session keys, but no stealing of the key.",
  "sig": "7062a75ddbb994942c57aca3b4a69ffb582b0e4998d84ef67d5c474ac597ec85fba8d50ce528aafea13552281da9f3e1d5158721f9491f3d0723c0f3a51dab47"
}