DigiNews

Summary

The post details a wormable vulnerability in ansi2html (CVE-2026-92973) that enables account takeover via injection in build logs on builds.sr.ht. It describes the vulnerability’s technical vectors, potential impact on deploy keys and admin access, timelines, and mitigations, and discusses coordination with upstream and CVE submission. It also provides indicators of compromise and defense-in-depth recommendations.