Stored XSS in ansi2html before 1.9.4 via SourceHut CI build logs enables account takeover

Weak escaping of OSC 8 hyperlink sequences in SourceHut's ansi2html lets attacker-controlled CI log output run script in viewers' browsers and enable account takeover; no CVE or in-the-wild exploitation reported.

A researcher disclosed stored cross-site scripting in SourceHut's ansi2html.py, the component that converts ANSI codes in builds.sr.ht job logs into HTML. Sam James reported to oss-security that ansi2html versions before 1.9.4 render crafted CI log lines as HTML, exposing log viewers to XSS; his post links an sr.ht account-takeover write-up and names no CVE. The underlying flaw is weak escaping of OSC 8 hyperlink sequences, which lets attacker-controlled URLs in log output inject script that runs when the build page is viewed. Poisoned logs can be created without a paid account via a public mailing list with CI, or by controlling output printed during a build. The injected script can read the page CSRF token, and if an administrator views the log it could seek admin rights and expose SourceHut deploy keys. The researcher filed an issue and a pull request. A 2026-09-25 oss-security follow-up by Sebastian Pipping only linked a related Hacker News thread, adding no CVE, patch, or exploit details. The reports agree on the XSS and account-takeover risk; only the oss-security post specifies the affected range as versions before 1.9.4. No exploitation in the wild is confirmed.

• Affected software: ansi2html before 1.9.4, used by SourceHut's builds.sr.ht to convert ANSI codes in job logs to HTML.
• Flaw: weak escaping of OSC 8 hyperlink sequences in ansi2html.py allows attacker-controlled URLs in build logs to inject script.
• Attack vector: poisoned build logs can be created without a paid account via a public mailing list with CI or by controlling build output.
• Impact: script runs when a log is viewed, can read the page CSRF token, and could give an admin viewer elevated access and expose SourceHut deploy keys.
• Disclosure timeline: researcher filed an issue and pull request; Sam James posted to oss-security on 2026-09-24; Sebastian Pipping followed up on 2026-09-25 with only a Hacker News link.
• No CVE identifier has been assigned in any report.
• No exploitation in the wild has been confirmed.
• Source agreement: all reports describe the same XSS and account-takeover risk; only the oss-security post specifies the affected version range (before 1.9.4).