Sourcehut account takeover via build logs (XSS in ansi2html)

blog.arusekk.pl

cross-posted to:
technology@lemmy.world

Sourcehut account takeover via build logs (XSS in ansi2html)

blog.arusekk.pl

RSS Bot@lemmy.bestiver.seBM to Hacker News@lemmy.bestiver.seEnglish · 1 month ago

cross-posted to:
technology@lemmy.world

SourceHut account takeover via build logs (XSS in ansi2html.py) | CVE-2026-92973

blog.arusekk.pl

A wormable vulnerability allowed anyone able to inject text in a build log on builds.sr.ht (or other instances) to take over accounts who viewed them

Comments

You must log in or register to comment.

Chat

Hacker News@lemmy.bestiver.se

hackernews@lemmy.bestiver.se

You are not logged in. However you can subscribe from another Fediverse account, for example Lemmy or Mastodon. To do this, paste the following into the search field of your instance: !hackernews@lemmy.bestiver.se

Community locked: only moderators can create posts. You can still comment on posts.

NOTICE: The bot occasionally has downtime, sorry about that. I’m working on adding better monitoring and error recovery so I can get notified faster.

Posts from the RSS Feed of HackerNews.

The feed sometimes contains ads and posts that have been removed by the mod team at HN.

Source of the RSS Bot.

Visibility: Public

This community can be federated to other instances and be posted/commented in by their users.

622 users / day
1.98K users / week
3.99K users / month
8.55K users / 6 months
12 local subscribers
5.71K subscribers
48.1K Posts
30K Comments
Modlog