This seems to be a front-end JavaScript exploit, so theres's a good chance that this is a Lemmy problem, not a Lemmy[dot]world problem. Don't be surprised if the issue starts spreading to other instances.
If I were running a server, I would take it offline until a patch is released (Beehaw did this, to be proactive).