Fun fact, Rebased is not vulnerable to the rich media vuln because the MR I proposed 2 years ago (and merged into Rebased) sanitizes the HTML: https://git.pleroma.social/pleroma/pleroma/-/merge_requests/3401/diffs#21b5f6a680dc114e2d13c5405e9f12aa00a7f29c_0_40