The vulnerability was discovered after Taiwanese singer Jay Chou had a Bored Ape NFT stolen in April, prompting the researchers to look into the details of the attack. After the researchers responsibly disclosed their findings to Rarible, Rarible implemented a fix. Rarible removed the ability for users to upload SVG files to patch the vulnerability; it's not clear if they intend to restore that functionality.
Bug discovered in popular Rarible platform: NFTs could execute malicious JavaScript
Security research group Check Point Research discovered a flaw in the NFT trading platform Rarible, which would have allowed an attacker to steal the entire contents of users' NFT wallets. A user who received a link to a malicious NFT, or clicks on it in the Rarible marketplace, would cause it to execute JavaScript code that would attempt to send a "setApprovalForAll" request, which an unsuspecting user would likely be less wary of when interacting with a known, trusted marketplace like Rarible.