Summary

Due to an oversight in the validation performed in UrlPreviewService and MkUrlPreview, it is possible for an attacker to inject arbitrary CSS into the MkUrlPreview component.

Details

UrlPreviewService.wrap falls back to returning the original URL if it's using a protocol that is likely to not be understood by Misskey, IE something other than http or https. This both can deanonymize users and allow further attacks in the client.
Additionally, MkUrlPreview doesn't escape CSS when applying a background-image property, allowing an attacker to craft a URL that applies arbitrary styles to the preview element.

PoC

• Have a webserver host a HTML page with a twitter:image opengraph attribute with the value of ftp://whatever-this-will-be-ignored/');position:fixed;top:0;left:0;width:100vw;height:100vh;z-index:9999;background-color:red;fixup:url('
• Make a note linking to said HTML page.
• When the note is rendered, it will show a big red square covering the entire post area (no mfm required!).

Impact

Theoretically, an attacker can craft a CSS injection payload to create a fake error message that can deceive the user into giving away their credentials or similar sensitive information.