GoKawiilSourcehut patches XSS flaw in ansi2html that enabled wormable account takeovers
A security researcher discovered a cross-site scripting vulnerability in the ansi2html tool used to render build logs on builds.sr.ht and other Sourcehut instances. The flaw let anyone inject malicious text into a build log, which would then execute in the browser of any user who viewed it, potentially hijacking their account and spreading further through the same mechanism.
GoKawiil's interpretation of the reporting above, not reported fact.
Because build logs are often shared or viewed by multiple collaborators, a self-propagating exploit like this could have spread across projects and teams before anyone noticed, according to the researcher's writeup. The case highlights how supporting tools like log renderers, not just core application code, can introduce serious security risks in developer platforms.
- The vulnerability stemmed from improper sanitization in ansi2html, a tool that converts terminal output into HTML for display.
- Exploitation required only the ability to inject text into a build log viewable by other users, making it a low-barrier attack vector.
- The flaw was wormable, meaning it could self-propagate as more users viewed compromised build logs and had their accounts taken over.
Source: blog.arusekk.pl, 2026-09-24
Published there as: “Sourcehut account takeover via build logs (XSS in ansi2html)”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.