A cross-site scripting vulnerability in Yahoo Mail could leave instant messenger users open to attack.