Alright, we found a second exploit that is much worse than the first one I found, it involves a bug in our oembed parser. A new release is being prepared right now. Unless there's a third exploit, this can be mitigated by disabling rich media in the pleroma settings. Frontends other than pleroma-fe might also be not vulnerable.

What alex is recommending here will also fix the issue, so you can do that as well:

https://gleasonator.com/notice/AW3PsTi4WCWEUbN0uO