SourceHut build log XSS let attackers take over accounts

A security researcher has disclosed a flaw that let a crafted build log take over SourceHut accounts. The bug sat in ansi2html, a Python library that turns colored terminal output into HTML, and it is tracked as CVE-2026-92973. Any project that renders untrusted logs with ansi2html versions 1.7.0 through 1.9.3 has the same exposure.

SourceHut is a hosted software forge, a service for Git repositories, mailing lists and continuous integration. Its CI service, builds.sr.ht, runs jobs and shows their logs in the browser. The researcher, who publishes as Arusekk, described the attack on September 23, 2026.

How a build log became an attack

The attack used cross-site scripting, or XSS. That means getting a website to run an attacker's JavaScript in a visitor's browser, with the visitor's logged-in session.

Terminals understand escape sequences, hidden codes mixed into text output. Most set colors. One kind, OSC 8, turns a piece of text into a clickable hyperlink. ansi2html translates these codes into HTML so a log looks the same on a web page.

According to the write-up, ansi2html did not escape the link target in OSC 8 sequences properly. A job could print a sequence whose "link" broke out of the HTML attribute and added new ones, including an event handler that runs code. Anyone who opened that job's log page would run it.

What an attacker could do

The injected script could read the page's CSRF token, the researcher writes. A CSRF token is the secret a site uses to confirm that a request really came from the user's own session. With it, the script could submit build jobs as the victim and reach their deploy keys, the credentials that jobs use to push code or ship releases.

The write-up reports no documented exploitation in the wild.

The disclosure timeline

SourceHut moved fast. The upstream library fix took a month longer, and public disclosure waited until both were out.

The ansi2html 1.9.4 release notes on GitHub list the fix as "osc8: ensure proper escaping," pull request 263. Arusekk wrote the patch and maintainer hartwork approved it.

Why auditing the dependency was not enough

The researcher makes a point that goes beyond this bug. The flaw lives in code that changes from release to release, so a one-time review cannot catch it. "Note how even carefully auditing ansi2html would not save SourceHut, unless redone on every bump," the write-up says.

A dependency that was safe when you reviewed it can grow a new feature later. An ordinary version bump then brings that feature, and any bug in it, straight into your product.

SourceHut has been in the news for its contribution rules this year, including its ban on LLM-assisted code and tickets. This disclosure is a reminder that the service's own code has a supply chain like everyone else's.

What this means for developers

Upgrade ansi2html to 1.9.4 or later wherever you use it. Search your lockfiles and container images, not just your direct requirements, because the library often arrives as a dependency of a test or CI tool. Running pip show ansi2html inside each environment tells you the version you actually ship.

Treat build output as hostile input. A CI log contains whatever a pull request's code chose to print. If your own dashboard renders logs as HTML, check that every attribute value is escaped. Add a Content Security Policy that blocks inline event handlers, so one missed escape does not become code execution.

Review what a stolen session could reach. Here, one page view exposed the power to start jobs and read deploy keys. Scope deploy keys to single repositories and rotate any you cannot account for.

Finally, re-read changelogs when a rendering or parsing library adds a feature. New escape-sequence support, new markup or new link handling are exactly the changes worth a second look.

This article was first published on Tech AI Wire.

Also available in

Deutsch · 日本語 · Français · Español · Português

Related on Tech AI Wire

• SourceHut bans LLM-assisted code and tickets from 10 September

Sources

• SourceHut account takeover via build logs - arusekk.pl
• ansi2html v1.9.4 - GitHub