Sourcehut account takeover via build logs (XSS in ansi2html)
A wormable vulnerability allowed anyone able to inject text in a build log on builds.sr.ht (or other instances) to take over accounts who viewed them
Read the full story at Hacker News ↗
ImpactMinor 25/100
Why it mattersRule-based estimate: no strong signals; trust 5/10.
RegionsGlobal
Published7 h ago (Thu, 24 Sep 2026 19:54:21 GMT)
RetrievedFri, 25 Sep 2026 00:00:14 GMT via api
ClassifiedFri, 25 Sep 2026 00:00:36 GMT by heuristic
AuthorArusekk