A security researcher stumbled onto a critical XSS vulnerability in SourceHut's build log rendering while trying to fix a CSS efficiency bug. The root cause: ansi2html.py, a Python library that converts ANSI terminal escape codes to HTML, failed to sanitize OSC 8 hyperlink sequences. An attacker could inject arbitrary HTML attributes — including event handlers like onfocus — or javascript: URIs directly into rendered build log pages, achieving stored XSS on builds.sr.ht. The attack surface was remarkably wide. No SourceHut account was required to trigger the vulnerability. An attacker could send a patch to any public mailing list with CI enabled, embedding the malicious ANSI escape sequence. The payload would then execute in the browser of anyone viewing the resulting build log — including administrators. Alternatively, controlling any remote resource printed during a build (a dependency URL, a mirror response) would achieve the same result. Weaponization was straightforward. The build log page already contained CSRF tokens in the DOM. A payload could read the token, resubmit build manifests, or — if an admin viewed the page — escalate privileges and exfiltrate deploy keys. On the flagship SourceHut instance, those deploy keys include credentials for SourceHut's own infrastructure. The researcher explicitly noted the worm potential: a self-propagating payload could chain through build logs. The vulnerability traces to ansi2html.py, one of the projects immortalized in Randall Munroe's "dependency" xkcd comic — a small, community-maintained library sitting under the pycontribs GitHub org. The repo had seen no activity for over a year. When the researcher contacted upstream maintainers, one didn't respond; the other asked to be contacted again in two weeks. The researcher ultimately helped revive the project, update build infrastructure, and ship multiple patched releases to PyPI. SourceHut's Drew DeVault patched the immediate issue by adding output sanitization in builds.sr.ht itself rather than waiting for the upstream fix. The researcher notes this was effective but overzealous — build logs now lack color rendering entirely. No Content-Security-Policy restrictions were in place to provide defense in depth; inline scripts were already used on the build log page, making CSP hardening non-trivial. The CVE (CVE-2026-92973) was scored under CVSS 4.0 with network attack vector, low complexity, no privileges required, and high confidentiality/integrity impact on the vulnerable system. The researcher argues — correctly — that CVSS scoring is structurally flawed for library vulnerabilities: the same code path produces radically different risk profiles depending on the consuming application. VulnCheck altered the researcher's original vector string, and the final scoring remains contested. This is a textbook illustration of the xkcd dependency problem made real. A library maintained by volunteers, embedded in critical CI infrastructure, with no security audit budget and no rapid-response capacity. The researcher found the bug by accident while trying to improve CSS efficiency. The gap between discovery and upstream patch spanned weeks of back-and-forth with semi-available maintainers. SourceHut's own mitigation was fast, but the systemic fragility — a single unaudited library converting untrusted terminal output to trusted HTML — remains the pattern that matters.
