UPDATE: Context and background now posted at Computerworld.

Following on from the discovery and the previous posting, see below; original content is in my feed somewhere but looks like:

<iMg Src=http://localhost/nope.gif onerror='javascript:alert("happy now ben?")'>

Twitter have had XSS bugs before, not Tweetdeck as far as I am aware – but then they used to have a proper client as opposed to a web interface.

Graham Cluley will doubtless be along shortly to tell us how [insert product name here] can protect us from all the stupid things that programmers do and fix only once.

WORKAROUND: DON’T USE THE WEB CLIENT, AND/OR REMOVE ANY FACEBOOK FEEDS FROM IT UNTIL THIS GETS FIXED. A BIT OBVIOUS, REALLY…