truth social is probably vulnerable to all sorts of mastodon cves considering they seem to still be using 3.4.1 but tragically one of those is not the tomo cve because that was only in prereleases of 4.3 (and also required federation to be on)