SecurityHacker Newsabout 3 hours ago
SourceHut account takeover via build log XSS
12 min read
A researcher found an XSS flaw in ansi2html, the library SourceHut uses to render CI build logs. An attacker can inject a malicious OSC 8 hyperlink into a public mailing list patch, executing JavaScript in any viewer's browser. SourceHut patched builds.sr.ht to sanitize output; ansi2html released several fixes to PyPI.
Level
Hype check
Tap to vote and see what everyone thinks.