This is a vulnerability writeup detailing an XSS in ansi2html that leads to Sourcehut account takeover via build logs. The researcher set up a sr.ht instance paying people for hosting projects, then cloned minimal repos. Source Hut uses microservices including builds.sr.ht for CI.

The researcher looked at build log page source and found repetitive CSS classes like .ansi38-150150150, indicating wasted compute. They investigated ansi2html, which converts ANSI escape codes to HTML, and filed an issue. After no repo activity for over a year, they submitted a PR fixing one issue.

Further hunting revealed two XSS vectors: one using OSC 8 hyperlinks with injected attributes like onfocus, and another using javascript: in href. Example exploits include printf commands generating malicious anchor tags. The researcher notes the code is not well-structured, enabling crafted input strings from a known XSS cheatsheet.

The writeup emphasizes the need for better input sanitization in ansi2html to prevent such attacks on build logs.