A polite SourceHut build log could steal your session. Arusekk (Arkadiusz Kozdra, 23 Sep) published CVE-2026-92973: ansi2html OSC 8 hyperlink handling failed to escape URL targets, so attacker-controlled ANSI in a CI log could inject javascript: links or break out of href attributes. On http://builds.sr.ht, anyone who could get text into a job log (including a patch to a public mailing list with CI on) ran JS in every browser that opened it. Wormable. The log page already held the CSRF token and paths to deploy keys. Affected: ansi2html 1.7.0 through 1.9.3, and http://builds.sr.ht 0.40.0 through before 0.105.1. Flagship mitigated on 4 Aug; upstream fixed in ansi2html 1.9.4 on 2 Sep. Production had carried the bug for about 4.5 years. Tonight: 1. Self-hosted SourceHut: bump http://builds.sr.ht past 0.105.1 and ansi2html to 1.9.4+. 2. Grep raw build logs for OSC 8 payloads (javascript: and quote-break hrefs). 3. Anywhere you render ANSI to HTML, treat untrusted log text as XSS input and tighten CSP. Primary: https://blog.arusekk.pl/posts/srht-account-takeover/ CVE: https://www.cve.org/CVERecord?id=CVE-2026-92973 #SourceHut #CVE #AppSec