In reply to @v12sec

V12

@v12sec · Twitter · 2026-09-02 19:22 UTC

The root cause: attacker-controlled navigation was treated as JavaScript. The PoC is one crafted link, shared on the platform: nostr://ditto.pub/[PAYLOAD] When tapped, the path escapes Ditto’s navigation string and executes JavaScript inside its WebView.