SourceHut account takeover via build logs: wormable XSS in ansi2html (CVE-2026-92973)

Security researcher Arusekk published a write-up in September 2026 describing an account-takeover vulnerability in SourceHut (sr.ht), the forge that hosts git repositories, mailing lists and continuous integration. It affected ansi2html, a Python library that converts ANSI escape sequences from terminal output into HTML, the component SourceHut uses to render build logs in its CI service, builds.sr.ht.

Anyone who could get text into a build log could have arbitrary JavaScript executed in the browser of every person who opened that log page. Because the page carries the CSRF token and the session's privileges, the attacker could act as the victim: submit build jobs in their name and reach deploy keys, including the keys SourceHut keeps for its own infrastructure on the flagship instance.

How the takeover worked

ansi2html does more than colourise text: it also turns automatic links and OSC 8 terminal hyperlinks into HTML anchors. The link target was copied into the href attribute without proper escaping, so a crafted escape sequence could break out of the attribute and add new ones, such as autofocus, tabindex and onfocus. A link written that way runs its payload as soon as the page loads, with no click required; a javascript: target worked too.

Getting the sequence into a log did not require an account: sending a patch to a public mailing list with CI enabled was enough, as was controlling any external resource whose output appears in the log. The result is a stored XSS on a widely visited page, and an automatable one: a victim immediately becomes the source of further attacks.

The fix and the timeline

The researcher reported the issue to SourceHut's security mailing list on 1 August 2026, together with a preliminary patch. On 4 August Drew DeVault confirmed the vulnerability and patched builds.sr.ht so that ansi2html output is sanitised automatically. In the pycontribs/ansi2html project the final fix shipped as version 1.9.4 on 2 September 2026. Affected versions are ansi2html 1.7.0 through 1.9.3 and builds.sr.ht 0.40.0 through 0.105.0.

The exposure window was long: ansi2html was wired into builds.sr.ht in March 2019, the bug appeared upstream in September 2021, and the affected version was packaged for Alpine and deployed on the flagship instance in February 2022. builds.sr.ht stayed vulnerable for almost exactly four and a half years.

What it means for other platforms

The case is a reminder about the risk of rendering untrusted build output as HTML. The researcher suggests three layers of defence: tightening the Content-Security-Policy and dropping 'unsafe-inline'; sanitising the converter's output, which SourceHut added but which he calls overzealous because colour rendering was lost; and rewriting the parser as a stateful automaton instead of ad-hoc string handling.