CVE-2026-92973: ansi2html 1.7.0a0 through 1.9.3 Cross-Site Scripting via OSC 8
ansi2html versions 1.7.0a0 through 1.9.3 contain a cross-site scripting vulnerability in OSC 8 hyperlink handling that fails to validate or escape URL targets. Attackers controlling ANSI text input can inject javascript: schemes or terminate href attributes to execute arbitrary scripts in the context of pages displaying converted output.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ansi2htmlto a version that resolves this vulnerability.Fixed in 1.9.3
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments using ansi2html versions 1.7.0a0 through 1.9.3 are exposed when they convert and display ANSI text that an attacker can control. The risk is in rendered HTML output containing OSC 8 hyperlinks.
What does exploitation require?
An attacker needs to supply ANSI text that is processed by the vulnerable converter and then viewed in a page displaying the converted output. No authentication is required, but a user must view the crafted output for script execution to occur.
What input should be treated as dangerous until remediation is available?
Treat untrusted ANSI input containing OSC 8 hyperlink sequences as dangerous, particularly URLs using javascript: schemes or values designed to break out of an href attribute. Avoid rendering such input as HTML in a browser until the vulnerable handling is addressed.