A researcher found a wormable cross-site scripting flaw in the ANSI-to-HTML conversion used by builds.sr.ht: ansi2html improperly handled OSC 8 hyperlink escape sequences so an attacker who can make arbitrary text appear in a build log (for example by sending a patch to a public mailing list or printing a remote resource during a build) can inject HTML attributes or javascript: URLs into anchors. When an authenticated user views the malicious log, the injected script can read the page’s CSRF token or use the existing resubmit-build form to submit jobs as that user, including jobs that use deploy keys. The practical impact includes full account takeover of viewers, access to deploy keys (including some for sr.ht itself on builds.sr.ht), and automated worm propagation across viewers.
The issue was reported and fixed: builds.sr.ht added automatic sanitization of ansi2html output and ansi2html upstream was updated with patched releases. The vulnerability was assigned CVE-2026-92973; affected ansi2html versions include >=1.7.0, =0.40.0, and <0.105.1. Recommended defenses are enforcing a stricter Content-Security-Policy, additional output sanitization, and refactoring the ansi2html parser. Indicators of compromise include raw log occurrences of OSC 8 escapes with embedded quotes or javascript: URLs (grepable by an ESC/7 pattern), and the researcher provides a full disclosure timeline and suggested CVSS vectors arguing for high/critical severity.
Summary generated by AI from the linked article. hn.today is not affiliated with Hacker News or Y Combinator.
OpenAI's actions have compromised Australia's health system, highlighting negligence and a lack of accountability. Experts argue that AI companies must be held responsible and adhere to safety and legal standards. (theguardian.com)
Health insurers like UnitedHealth, Humana, and Cigna are using AI to deny medical claims, risking patients' access to necessary care. Medicare has also implemented AI tools to approve prior authorizations, leading to reports of patients being denied treatment despite medical necessity. (vox.com)
GitLab.com is experiencing a service disruption with reports of 503 errors, currently under investigation. Most components, including Git operations and CI/CD pipelines, remain operational. (status.gitlab.com)
Over $170 million in cryptocurrency was transferred from Bitget wallets to an unidentified address. The movement of funds raises concerns about security and potential hacking activity. (theblock.co)
Bitget exchange wallets lost $183 million in a hack, raising concerns among users. The incident involves a significant theft of cryptocurrency assets from the platform's wallets. (decrypt.co)
Lindsey Isaacs spent 86 hours in solitary confinement after a Flock Safety camera linked her SUV to a fatal crash, leading to her arrest on felony charges. Prosecutors later dropped all charges, citing contradictory physical evidence, and advocates call for stricter standards for camera-supported arrests. (gadgetreview.com)
Today's best Hacker News stories, summarized and screenshotted, one email a day.