2 mentions in 7 days · 2 in 30 days · 2 total · first seen · last
ansi2html before 1.9.4 converted crafted sr.ht CI log lines into HTML, enabling XSS for viewers.
Sam James reported on oss-security that ansi2html versions before 1.9.4 can turn crafted lines in a build log into HTML. On SourceHut's sr.ht CI service, that behavior allowed cross-site scripting against people viewing the log. The report points to a write-up of an sr.ht account-takeover scenario; no CVE is named in the post.
Stored XSS in SourceHut's ansi2html can run script from CI build logs and enable account takeover.
A researcher disclosed a cross-site scripting flaw in SourceHut's ansi2html.py, which converts ANSI codes in builds.sr.ht job logs into HTML. Weak escaping of OSC 8 hyperlink sequences lets attacker-controlled log output inject script that runs when someone views the build page. Logs can be poisoned without a paid account via a public mailing list with CI, or by controlling output printed during a build. Injected script can read the page CSRF token and, if an administrator views the log, could seek admin rights and SourceHut deploy keys. The author opened an issue and a pull request; no CVE or in-the-wild exploitation is reported.