Sourcehut account takeover via build logs (XSS in ansi2html)
A wormable vulnerability allowed anyone able to inject text in a build log on builds.sr.ht (or other instances) to take over accounts who viewed them
Summary
A vulnerability in Sourcehut’s build log system could let malicious users take control of accounts by injecting harmful text. This security flaw highlights the risks associated with viewing untrusted build logs.
Comments (27 of ) ⌛