GoKawiilSourcehut patches XSS flaw in ansi2html that enabled wormable account takeovers
A security researcher discovered a cross-site scripting vulnerability in the ansi2html tool used to render build logs on builds.sr.ht and other Sourcehut instances. The flaw let anyone inject malicious text into a build log, which would then execute in the browser of any user who viewed it, potentially hijacking their account and spreading further through the same mechanism.