SourceHut Fixes a Build-Log XSS Bug Rated Only Medium

An attacker who could get arbitrary text into a SourceHut build log [by mailing a patch to a public project with continuous integration turned on, or by controlling any remote resource a build happened to print] could hijack the browser session of anyone who viewed that log, without ever creating a SourceHut account. Security researcher Arusekk disclosed the bug on Sept. 23 as CVE-2026-92973, a cross-site-scripting flaw in ansi2html, the Python library builds.sr.ht uses to render logs as HTML.

Arusekk reported the issue to SourceHut's security list on Aug. 1. SourceHut founder Drew DeVault confirmed a mitigation in builds.sr.ht's own code three days later, on Aug. 4, but the underlying library did not ship a real fix until Sept. 2, when ansi2html 1.9.4 closed the hole upstream. Arch Linux updated its package on Sept. 5.

The root cause sits in how ansi2html turns a terminal's OSC 8 hyperlink escape sequences into HTML anchor tags. The converter did not validate or escape the URL an attacker embeds in that sequence, so a log containing a crafted javascript: link, or one that simply breaks out of the href attribute, could plant an onfocus handler that fires the moment a victim's browser renders the page.

What the payload could reach, once triggered

SourceHut's build logs are unusually easy to poison: a public repository with continuous integration enabled will run and log a mailed-in patch before anyone reviews it, and any external resource a build fetches and prints counts too. Arusekk described the resulting page as itself hostile: "a build job... that executes your payload in every browser that views it," wormable in the sense that one poisoned log can compromise every subsequent viewer, moderators included.

Running script in that context exposed a victim's CSRF token, enough to resubmit a build under their identity, plus any deploy keys attached to their account. On SourceHut's flagship instance, Arusekk wrote that the chain could reach deploy keys "for sr.ht itself," the infrastructure running the service rather than a single user's own projects.

Four and a half years between two package updates

The timeline runs from an upstream commit to a fix nobody went looking for until Arusekk did.

Date	Event
Sept. 3, 2021	Bug introduced into ansi2html upstream
Feb. 8, 2022	Affected version packaged for Alpine, goes live on SourceHut's flagship instance
Aug. 1, 2026	Arusekk reports the bug to SourceHut's security list
Aug. 4, 2026	SourceHut mitigates builds.sr.ht; Drew DeVault confirms
Sept. 2, 2026	Ansi2html 1.9.4 ships the upstream fix
Sept. 5, 2026	Arch Linux updates its ansi2html package
Sept. 23, 2026	Arusekk publishes the write-up as CVE-2026-92973

The score understates it

CVE-2026-92973 carries a CVSS v3.1 score of 6.1 and a v4.0 score of 5.3, both medium severity, because the CVE record scores ansi2html as a generic library: a stored XSS that needs a user to open a crafted link. Arusekk disputed that rating directly: "I would argue for high or critical, not just a mere medium." The base score does not account for SourceHut's specific chain, where merely viewing a build log triggered the payload and the reachable assets included deploy keys to the service's own infrastructure rather than an ordinary user's data.

It is not the only recent case on this beat where a score and the practical risk have diverged: a UC San Diego-led team forged RSA-1024 signatures for 1,380 CPU core-years, an attack whose real-world cost depends entirely on preconditions a single number cannot capture. SourceHut is also not the only decentralized code-hosting project working through a protocol-level disclosure this month; Radicle disclosed two unpatched network flaws of its own on Sept. 23, the same day Arusekk's post went up.

Arusekk's write-up does not say whether the bug was exploited before the patch, and neither SourceHut nor the ansi2html project has published an incident notice tied to it. Self-hosted builds.sr.ht operators need version 0.105.1 or later, paired with ansi2html 1.9.4 or later, to close both sides of the chain; SourceHut's own packaging pulls ansi2html in as a separately versioned dependency, the same path that let a 2021 upstream bug reach its servers only after an unrelated Alpine packaging update in 2022.