SourceHut, a software development platform, recently addressed a critical security vulnerability (CVE-2026-92973) that allowed for account takeovers via its continuous integration service, builds.sr.ht. The flaw originated in ansi2html, a Python library used by the platform to convert ANSI escape sequences—commonly used for terminal color and formatting—into HTML for display in web-based build logs. An attacker could inject malicious payloads into these logs by including specific ANSI sequences, such as OSC 8 hyperlinks, which the library failed to sanitize properly. By crafting a payload that included JavaScript, an attacker could execute arbitrary code in the browser of any user who viewed the compromised build log. This vulnerability was particularly severe because it could be triggered without an account on the platform, such as by submitting a patch to a public mailing list that triggers an automated build. Once a victim viewed the log, the injected script could potentially access sensitive information, including CSRF tokens, or perform unauthorized actions like submitting new build jobs or accessing deploy keys. The issue persisted for several years before being identified and patched in September 2026. SourceHut mitigated the risk by implementing stricter sanitization of build log output, while the upstream ansi2html project released a fix to address the underlying XSS vulnerability.