Vulnerabilitymedium
XSS vulnerability in <ansi2html-1.9.4
AI summary · grok-4.7Summaries by Vani AI
ansi2html before 1.9.4 converted crafted sr.ht CI log lines into HTML, enabling XSS for viewers.
Sam James reported on oss-security that ansi2html versions before 1.9.4 can turn crafted lines in a build log into HTML. On SourceHut's sr.ht CI service, that behavior allowed cross-site scripting against people viewing the log. The report points to a write-up of an sr.ht account-takeover scenario; no CVE is named in the post.
Key facts
- ansi2html before 1.9.4 is affected
- Crafted sr.ht CI build-log lines were rendered as HTML
- Viewers of those logs could be hit by XSS
- Disclosure posted to oss-security by Sam James
From the original article
Posted by Sam James on Sep 24 Hi, https://blog. arusekk. pl/posts/srht-account-takeover/ In short, crafted lines in a build log on sr.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.