Post

To make sure I'm understanding this correctly, this is ONLY an issue with an on-screen chat display, not the regular chat dock in OBS, correct?

that is correct, the OFFICIAL chat dock in OBS sanitizes user text. idk if any third parties hook into that and like to fuck with it, but the official one (the default) sanitizes.

Okay, whew. I was terrified. I'm using frankly ancient copies of OBS nvidia drivers because I'm afraid of trying to install a new one (my laptop has had issues that seem to be tied to video) and new OBS requires a version higher than what I've got. Restream.io's chat dock (no overlay) is fine too?

Ohhhhh I get it, this is a Robert'); DROP TABLE Students;-- isn't it?

To make it easier, here's a dirty check if your overlay does suffer from regular injection by pasting the attached message into a twitch chat. If your chat overlay no longer has a transparent background and/or reloads (after 1 second or immediately), then it is affected.

Wanted to ask for some clarification on the tests, on the first test I'm using a Streamelements overlay and i just got an empty chat bubble (color didn't change) and for the second test just the raw text appeared, is this a good sign?

That’s kinda suspicious. If it just shows the raw code then you are fine, but the entire thing being gone could mean it’s being sinked (bad) or there’s custom overlay code filtering it out (good). Try a chat message that is <b>test</b> See what your output is.

So if I don't have an overlay at all and only stream the game without a camera or chat window or anything, I'm safe?

100% safe this only affects browser sources/overlays in OBS. if you made all your overlays in static images, you'd be fine.

so I did the first command, the only words that turn purple are "document.body.style" and "window.location.reload", guessing I'm affected?

in the twitch chat, not the chat overlay

Should you check? Yes. Are you likely affected? No. Does this affect all overlays? No. You can also mitigate this by filtering the links that are posted in chat or disable links all together. I'd suggest filtering. If you are affected, my commissions are open, I can fix overlays for like $20.

Thank you for giving all this context! So if I'm hearing it right, if I have links disabled I won't be effected by this? I don't have links enabled anyway by default thankfully.

IMO one of the points here is that the onus of sanitization is on the overlay maker. So if you're using StreamElements or Streamlabs, it's their responsibility. As a user the overlay, you have a lot less ability to do sanitization other than the filtering mentioned.

so i been using streamlabs chat for my overly i should be fine to keep using it? or should i just remove it for now?

From digging in and finding the disclosure blog post that Zach didn't post. The fun overlay in the video was made with Claude Code, so you know it's expertly made and totally good. 🙄 Again, this probably doesn't effect the majority of overlays. But still. OBS patch won't fix a broken overlay tho.

I'm too lazy to install chat overlay in my OBS, am I fine?

If you don’t have overlays that can take external input from chatters, then you are fine, yes.