A cross-site scripting bug in a build-log viewer was enough to take over Sourcehut accounts.
A security researcher published a write-up describing how ansi2html, the tool Sourcehut uses to turn build-log output into HTML for its web dashboard, failed to properly handle attacker-controlled content. Because build logs often include text that users or their dependencies can influence, that gap let malicious script run in the browser of anyone viewing the log. From there, the researcher showed the bug could be chained into taking over a victim's Sourcehut account. The write-up is posted at blog.arusekk.pl and had drawn only light attention on Hacker News as of publication - 32 points and three comments.
This is a familiar failure mode, not a new one. CI and build systems routinely pipe untrusted output - commit messages, dependency names, test failures - straight into a browser-rendered log, and any gap in escaping turns that pipeline into an XSS vector. Sourcehut markets itself as a deliberately minimal, hacker-run alternative to GitHub and GitLab, built by people who care about doing fewer things correctly. A bug in something as basic as log formatting is an awkward look for that pitch.
Whether Sourcehut has shipped a fix is not stated in the report. Given how quiet the disclosure has been so far, it is worth watching for an official advisory before assuming this is closed.