Re: XSS vulnerability in <ansi2html-1.9.4
An oss-security reply points to a Hacker News thread on XSS in ansi2html 1.9.4.
22
An oss-security reply points to a Hacker News thread on XSS in ansi2html 1.9.4.
ansi2html before 1.9.4 converted crafted sr.ht CI log lines into HTML, enabling XSS for viewers.
Stored XSS in SourceHut's ansi2html can run script from CI build logs and enable account takeover.
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.
Today 1.6K readers · 2.5K views · 779 reads · all time 189K views