Post

Okay a tiny thread because people are going to freak out: This exploit in particular takes advantage of a special command that renders images (via attribute escape). If you have an overlay that processes images (most don't) then yes, this is your problem. Overlay must explicitly create img DOM.

To make it easier, here's a dirty check if your overlay does suffer from regular injection by pasting the attached message into a twitch chat. If your chat overlay no longer has a transparent background and/or reloads (after 1 second or immediately), then it is affected.

Thank you for giving all this context! So if I'm hearing it right, if I have links disabled I won't be effected by this? I don't have links enabled anyway by default thankfully.

IMO one of the points here is that the onus of sanitization is on the overlay maker. So if you're using StreamElements or Streamlabs, it's their responsibility. As a user the overlay, you have a lot less ability to do sanitization other than the filtering mentioned.

StreamElements/Streamlabs have access to the source code of their chat overlays. Majority of overlays on those platforms are community made.

so i been using streamlabs chat for my overly i should be fine to keep using it? or should i just remove it for now?

run the commands in the link in this post. if nothing happens, you are safe. if stuff happens, you need overlay updates. the obs update will only patch someone taking over your pc, would not stop someone from doing something funny like post images all over your screen.

so pretty much have the chat box running and use those in my Twitch chat?

From digging in and finding the disclosure blog post that Zach didn't post. The fun overlay in the video was made with Claude Code, so you know it's expertly made and totally good. 🙄 Again, this probably doesn't effect the majority of overlays. But still. OBS patch won't fix a broken overlay tho.