TECHNOLOGY
Wormable Flaw in SourceHut Build Logs Could Have Hijacked Viewers' Accounts
A security researcher found a self-spreading XSS vulnerability in builds.sr.ht that let attackers hijack the accounts of anyone who merely viewed a poisoned build log.
Image: IntraGoals Media · Uploaded by IntraGoals — usage rights confirmed
A researcher probing the open-source SourceHut platform has disclosed a serious vulnerability in builds.sr.ht, the service's continuous-integration build system, that could have let an attacker take over the account of anyone who simply viewed a compromised build log.
According to a report shared on Hacker News, the flaw was wormable, meaning that once triggered, it could automatically spread from one victim to another without further action by the attacker. The underlying issue was a cross-site scripting (XSS) bug in ansi2html, a tool used to convert terminal output into HTML for display in build logs. Because build logs often contain text that originates from user-controlled build processes, anyone able to inject content into a log could plant malicious code that executed in the browser of whoever later viewed it.
The researcher who found the bug says the discovery came about somewhat by accident. While setting up a project to pay contributors for hosting their code on a self-hosted SourceHut instance, they began examining a minimal subset of the platform's source code and stumbled onto the vulnerability during that process.
Because builds.sr.ht is open-source software used both by the flagship sr.ht service and by independent instances run by other organizations, the flaw was not confined to a single deployment. Any installation running the vulnerable ansi2html-based log rendering would have been exposed, meaning the practical reach of the bug potentially extended well beyond SourceHut's own servers.
Account takeover via a viewed log page is a particularly dangerous class of vulnerability because it requires no active participation from the victim beyond visiting a page they would ordinarily trust — checking the status of their own build. Combined with the wormable nature of the exploit, a single injected payload could theoretically cascade across many accounts on a shared instance before anyone noticed.
Details on remediation, how long the vulnerability existed before discovery, and whether it was exploited in the wild before being reported were not included in the available material. SourceHut maintainers have not yet issued a public statement addressing the specifics of the fix. Readers should treat the technical account as preliminary until the project publishes its own advisory or changelog confirming the patch.