From 0016b9b7ff1047768259433c3d4301872719c985 Mon Sep 17 00:00:00 2001
From: Vendicated <vendicated@riseup.net>
Date: Mon, 14 Sep 2026 22:29:33 +0200
Subject: [PATCH] MessageLinkEmbeds: limit embed count to prevent DoS

---
 src/plugins/messageLinkEmbeds/index.tsx | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/src/plugins/messageLinkEmbeds/index.tsx b/src/plugins/messageLinkEmbeds/index.tsx
index 92aaecd98..6d761a0bc 100644
--- a/src/plugins/messageLinkEmbeds/index.tsx
+++ b/src/plugins/messageLinkEmbeds/index.tsx
@@ -236,11 +236,16 @@ function MessageEmbedAccessory({ message }: { message: Message; }) {
 
     const accessories = [] as (JSX.Element | null)[];
 
+    const seen = new Set<string>();
+    let count = 0;
     for (const [_, channelId, messageId] of message.content!.matchAll(messageLinkRegex)) {
-        if (embeddedBy.includes(messageId) || embeddedBy.length > 2) {
+        if (embeddedBy.includes(messageId) || embeddedBy.length > 2 || seen.has(messageId) || count >= 5) {
             continue;
         }
 
+        seen.add(messageId);
+        count++;
+
         const linkedChannel = ChannelStore.getChannel(channelId);
         if (!linkedChannel || (!linkedChannel.isPrivate() && !PermissionStore.can(PermissionsBits.VIEW_CHANNEL, linkedChannel))) {
             continue;