SourceHut patches build-log flaw that could run attacker code in viewers' browsers

A security researcher disclosed a flaw in SourceHut's build-log display that could let an attacker place browser-executed code in a job log. The researcher said crafted hyperlink control sequences passed through the ansi2html converter could become unsafe links or page elements when someone viewed the log. The researcher said an attacker could get malicious text into a log through a patch sent to a public mailing list with continuous integration enabled. Code running in a viewer's browser could then act with that viewer's SourceHut access, potentially exposing build credentials. SourceHut patched its build service to sanitize the converted output; the account does not establish that attackers used the flaw.