[PSA] Do not click Steam Profile Links - Security Flaw Just Exposed. IT IS NOW FIXED

I wonder if the steam forums are safe. Seems like anything you can execute in your profile should be able to execute on the forums as well.

Oh, damn it, Volvo...

I just clicked on the profile of 2 bots.....

Couldnt a malicious user potentially use Steamgifts giveaways as a shoehorn into something like this exploit? "Will friend request the winner" a.s.o....

Thank you for alerting this to everyone, looks like i'm going to lay off trading today.

i just clicked a bot profile to report it and block it.... Oh no...

Why do I have a feeling that this is going to spread like wild fire, before Valve fix it?

Thanks for the PSA, Deiru.

They never fixed this? Gaddangit valve! Welp, now that pretty much everybody on the planet knows of it now time to set everything to private. :/

Thx to for the heads up..and in a better world i would have expected Volvo for shutting down the profiles until the problem is solved..

Wow, that's interesting. Thank you for the heads up, Deiru.

any ideas on when would this be fixed?

Eh, not cool. I visit quite a few profiles, and check my own frequently. I've disabled all comments on mine, made inventory private, and will keep email trade notifications enabled. Hopefully that will keep my own profile safe to view... :/

Then that's why Steam's support is taking so much to attend my ticket? :P

Wasn't there like the SAME issue with steam store pages where devs could put malicious shit on their game page; and it was known for like forever but Valve didn't do shit about it... Then when a dev decided to demonstrate the exploit to urge them to action he got banned or something? You'd think they'd check around for similar things elsewhere after an incident like that....?

So that's why these invites keep popping up now. And I did check one of them because of a higher lvl :(
Hope it was clean...

Would this apply to steam groups as well maybe?

My own profile should be safe as long as i keep comments private and dont talk, friend, chat or trade with anyone or watch their profile?

Imagine this happening on facebook, there would be ALOT of pissed off stalkers ...
Anyways this problem didn't just apear out of thin air, why did they take their sweet time fixing in?

Using steam client is like walking on a minefield atm. Thanks for the heads up.

I just visited a bunch of profiles recently D:

Thanks for the heads up.

The XSS issue on Steam Community has been resolved.
https://twitter.com/SteamDB

Also, have anyone noticed that Twitch has kind of acted up today? (It has for a lot of people). Possible link?

(Not trying to make conspiracy theories, i'm just throwing it out there, just in case.)

Fixed