3 mentions in 7 days · 3 in 30 days · 3 total · first seen · last
An oss-security reply points to a Hacker News thread on XSS in ansi2html 1.9.4.
Sebastian Pipping posted a brief oss-security follow-up about an XSS vulnerability in ansi2html before version 1.9.4. The message gives no technical details, CVE, or patch information and only links a related Hacker News thread. Nothing in the post says the flaw is being exploited.
ansi2html before 1.9.4 converted crafted sr.ht CI log lines into HTML, enabling XSS for viewers.
Sam James reported on oss-security that ansi2html versions before 1.9.4 can turn crafted lines in a build log into HTML. On SourceHut's sr.ht CI service, that behavior allowed cross-site scripting against people viewing the log. The report points to a write-up of an sr.ht account-takeover scenario; no CVE is named in the post.
Stored XSS in SourceHut's ansi2html can run script from CI build logs and enable account takeover.
A researcher disclosed a cross-site scripting flaw in SourceHut's ansi2html.py, which converts ANSI codes in builds.sr.ht job logs into HTML. Weak escaping of OSC 8 hyperlink sequences lets attacker-controlled log output inject script that runs when someone views the build page. Logs can be poisoned without a paid account via a public mailing list with CI, or by controlling output printed during a build. Injected script can read the page CSRF token and, if an administrator views the log, could seek admin rights and SourceHut deploy keys. The author opened an issue and a pull request; no CVE or in-the-wild exploitation is reported.