SourceHut account takeover via build logs (XSS in ansi2html.py)

Lobsters·95 points·winter·6 days ago·blog.arusekk.pl

A wormable vulnerability allowed anyone able to inject text in a build log on builds.sr.ht (or other instances) to take over accounts who viewed them

Read the full article at blog.arusekk.pl →

#account #logs #takeover #sourcehut #xss #ansi2html #account takeover #sourcehut account

Related stories

Sourcehut account takeover via build logs (XSS in ansi2html)blog.arusekk.pl
Hacker News · 134 points · 6 days ago
Ask HN: Does a startup need both founder and company X accounts?
Hacker News · 3 points · 6 days ago
Understand any Bluesky account (Jev)jev.0x0.boo
Hacker News · 3 points · 11 days ago
Show HN: Deterministic UI testing that checks backend logs, not just the UIget-verirun.duely.in
Hacker News · 1 points · 10 days ago
Dialedin – Put your lab PDFs, protocols and daily logs on one timelinedialedin.bio
Hacker News · 1 points · 10 days ago
Underclass: An OpenAI-compatible pooling proxy that pins sessions to one accountgithub.com
Hacker News · 2 points · 11 days ago

Related topics

x27218 development102 contribute74 creating30 maybe9 takeover7 xss4 jev349 system179