#ansiescape

· 2w ago

For 4,5 years anyone could add rogue JavaScript to build log page by submitting a builds.sr.ht job with OSC 8 escape codes. The attacker could submit build jobs on behalf of the victim viewing the build logs, up to even deploying rogue software on the flagship instance. Curious? Read about the whole journey here: https://blog.arusekk.pl/posts/srht-account-takeover/ #cve_2026_92973 #srht #sourcehut #xss #security #osc8 #ansiescape #ci #vulnerability

Arusekk blog

SourceHut account takeover via build logs (XSS in ansi2html.py) | CVE-2026-92973

A wormable vulnerability allowed anyone able to inject text in a build log on builds.sr.ht (or other instances) to take over accounts who viewed them

Hacker News @h4ckernews@mastodon.social

· 2mo ago

ANSI escape injection in MCP servers: Hidden from humans, visible to AI https://brightsec.com/research/detecting-ansi-escape-sequence-injection-in-mcp-servers-with-dast/ Comments: https://news.ycombinator.com/item?id=48989006 #HackerNews #ANSIescape #MCPservers #cybersecurity #AIdetection #vulnerability

Bright Security

Detecting ANSI Escape Sequence Injection in MCP Servers with DAST | Bright Security

ANSI escape sequences were designed for terminals, not for language models. They are invisible control codes that tell a terminal to change colors, hide text,

You've seen all posts