Update 1/14/08: Unfortunately, it seems like changing the default RSS reader isn't enough. Mastenbrook has updated his blog post with a more comprehensive solution, which involves redirecting URL handlers for feeds. Full details at the link below.

There’s nothing we love more than a good security vulnerability. It just goes to remind you once again that the only truly secure computer is that old SE/30 in your basement that’s not even plugged in and is kept under lock and key.

Programmer Brian Mastenbrook identified the flaw, which affects any Mac user who hasn’t changed the default option for RSS reader in Safari’s preferences (that default reader being, naturally, Safari itself). The vulnerability could allow a Web site to read data stored on the user’s computer, including sensitive information like logins and passwords, without notifying the user. The flaw is far-reaching, affecting both Mac and Windows users running Safari, as well as Mac users who use other browsers like Firefox but still haven’t changed Safari's RSS preferences.

In terms of a workaround, Windows Safari users should switch to another browser until the problem is fixed; Mac users should just switch the default RSS reader from Safari in Safari’s Preferences -> RSS panel. You can change it to anything you like, whether it be a free client such as NetNewsWire or Vienna; if you're running Leopard, you can even change it to Mail.

Apple has acknowledged the vulnerability, but there’s no news on when a patch might be forthcoming. Thus far it seems as though knowledge of the flaw’s details is not yet public, so there’s no need for panic, but taking precautions is always good.

[via Daring Fireball]

Updated with suggestions for alternate RSS readers.