SourceHut account takeover via build logs (XSS in ansi2html.py)

8.2 relevance

Detailed security vulnerability with immediate actionable steps for users.

General blog.arusekk.pl

Answer the board on AI readiness

Arrive with evidence, not opinion. See how your foundation benchmarks against your peers, get a clear read, and leave with a ranked place to start.

Why It Matters

For a solutions architect focused on CI/CD and platform engineering, this highlights the critical need for input sanitization in build log rendering and the risks of unmaintained open-source dependencies in microservice architectures.

Key Takeaways

Audit your CI/CD log rendering for XSS vulnerabilities, especially when using ANSI-to-HTML converters, and ensure active maintenance of security-critical dependencies.

Summary

A researcher discovered an XSS vulnerability in SourceHut's builds.sr.ht microservice, where the ansi2html.py script improperly sanitizes OSC 8 hyperlinks, allowing injection of arbitrary HTML attributes (e.g., onfocus) to execute JavaScript and achieve account takeover. The code had been unmaintained for over a year before a fix was submitted.

Author

Arusekk