Lemmy is vulnerable to javascript: links, see this post for more details.