SourceHut account takeover via build logs (XSS in ansi2html.py)
Stored XSS in SourceHut's ansi2html can run script from CI build logs and enable account takeover.
A researcher disclosed a cross-site scripting flaw in SourceHut's ansi2html.py, which converts ANSI codes in builds.sr.ht job logs into HTML. Weak escaping of OSC 8 hyperlink sequences lets attacker-controlled log output inject script that runs when someone views the build page. Logs can be poisoned without a paid account via a public mailing list with CI, or by controlling output printed during a build. Injected script can read the page CSRF token and, if an administrator views the log, could seek admin rights and SourceHut deploy keys. The author opened an issue and a pull request; no CVE or in-the-wild exploitation is reported.
54