#sourcehut

1 stories this week · 1 this month · 3 in 6 months · mostly security

Stories per day · 30 days

3 stories, newest first · one card per story

A logic bug introduced in 2021 allows registration even when disabled in SourceHut versions 0.56.11-0.88.9 if SMTP is configured.

ansi2html before 1.9.4 converted crafted sr.ht CI log lines into HTML, enabling XSS for viewers.

Stored XSS in SourceHut's ansi2html can run script from CI build logs and enable account takeover.

Stories tagged #sourcehut