● Covered by 1 source · 1 reportMedium impact1 neutral
Sourcehut Account Takeover Vulnerability Discovered via XSS in Build Logs
Key points
- Vulnerability found in Sourcehut's build log display.
- XSS flaw in ansi2html component allowed account takeover.
- Sourcehut uses a microservices architecture.
- The researcher was examining build logs when the issue was found.
Background on Sourcehut's Architecture
Sourcehut operates as a collection of microservices, including meta.sr.ht, git.sr.ht, hub.sr.ht, and builds.sr.ht, which serves as its continuous integration (CI) system. Another component, mirror.sr.ht, provides prebuilt packages for various microservices. This modular approach facilitates development and deployment.
Discovery of the Vulnerability
The vulnerability was identified while a researcher was examining the page source of build logs on builds.sr.ht. The researcher noticed repetitive CSS class definitions related to ANSI color codes, which prompted a deeper investigation into how the build logs were rendered. This led to the discovery of a Cross-Site Scripting (XSS) flaw within the ansi2html component.
Impact of the XSS Flaw
The XSS vulnerability in ansi2html allowed for an account takeover on Sourcehut. This type of flaw occurs when an application includes untrusted data in a web page without proper validation or escaping, enabling attackers to inject malicious scripts that can steal session cookies or perform actions on behalf of the user.
Implications for CI/CD Systems
This incident underscores the importance of rigorous security practices in CI/CD environments, particularly when displaying output from user-controlled build processes. Even seemingly innocuous data like build logs can contain malicious payloads if not properly sanitized, leading to significant security breaches.
✨ This summary was generated by AI from the outlets' reporting listed below. It is not independently verified and may contain errors — check the original sources. How BrevFeed works →
The daily brief
One email each morning: the day's tech stories, clustered across outlets and summarized. No account needed.
One email a day. Unsubscribe in one click, any time.
Today's brief
Spend a few minutes, get the whole day. Every topic's top stories in one hands-free rundown — listen, watch, or read the transcript.
▶ Play today's brief
New every morning, and the back catalogue is archived by date.
Primary sources
GitHub pycontribs/ansi2html GitHub adityatelange/hugo-PaperMod CVE CVE-2026-929736.1 MEDIUMReporting from
A vulnerability allowing account takeover on Sourcehut was discovered, stemming from a Cross-Site Scripting (XSS) flaw within the ansi2html component used for displaying build logs. This issue highlights the security risks associated with rendering user-controlled content, even in seemingly benign contexts like CI/CD output.