You should uninstall your GreaseMonkey Extensions.

Following the thread here, you can see an exploit discovered by Mark Pilgrim that actually allows website programmers to find and use Greasemonkey if it's enabled on the user's browser - including the GM_XMLHttpRequest object - which can GET and POST any URL to any URL with no restrictions - including local files and local directory listings. This is very insecure, and I've uninstalled GM on all of my machines, and advise others to do so as well. I'll be following the Mailing List to see how things develop, hopefully there will be a usable workaround.

 

3 Comments +