XSS vulnerability in <ansi2html-1.9.4
ansi2html before 1.9.4 converted crafted sr.ht CI log lines into HTML, enabling XSS for viewers.
Sam James reported on oss-security that ansi2html versions before 1.9.4 can turn crafted lines in a build log into HTML. On SourceHut's sr.ht CI service, that behavior allowed cross-site scripting against people viewing the log. The report points to a write-up of an sr.ht account-takeover scenario; no CVE is named in the post.
- ansi2html before 1.9.4 is affected
- Crafted sr.ht CI build-log lines were rendered as HTML
- Viewers of those logs could be hit by XSS
- Disclosure posted to oss-security by Sam James
Posted by Sam James on Sep 24 Hi, https://blog.arusekk.pl/posts/srht-account-takeover/ In short, crafted lines in a build log on sr.ht's Ci service were transformed into HTML by ansi2html, and allowed XSS for viewers of that log. I've attached a plain text version of the post but it's not particularly easy...
This source does not provide full text. Read it at seclists.org.