How the Tumblr worm spread so quickly

Apparently hackers found a way to bypass Tumblr's security by hiding malicious javascript code into posts using the data uri scheme.

It appears that the worm took advantage of Tumblr's reblogging feature, meaning that anyone who was logged into Tumblr would automatically reblog the infectious post if they visited one of the offending pages.

Full Article