← Saturday, September 26, 2026SecurityVulnerability

XSS in SourceHut build logs enabled account takeover

blog.arusekk.pl 11 min read Editor score 7/10

A flaw in ansi2html allowed cross-site scripting through SourceHut build logs and led to account takeover. Engineers running CI or log-rendering services should consider how terminal formatting can turn untrusted build output into executable content.

What

SourceHut’s builds.sr.ht CI displays build logs converted from ANSI escape codes to HTML by ansi2html.

How

Inspection found repeated generated CSS classes; ansi2html also handles automatic links and OSC 8 hyperlinks.

Why it matters

Reducing duplicate styles can cut compute and bandwidth in build-log rendering; hyperlink parsing is another area to scrutinize.

Read on blog.arusekk.pl → Hacker News · 29 comments

Headline, summary, brief and diagram are written by a model from the source's own text; the link, byline and numbers come from the source. Read the original before relying on a claim.