Executive brief
ansi2html is a library that converts text with ANSI color codes into HTML for display in web pages and terminals. A vulnerability in its OSC 8 hyperlink processing fails to properly validate or escape URLs, allowing attackers who control ANSI-encoded input to inject malicious JavaScript code that executes in the browser when the converted HTML is displayed.
Technical details
The vulnerability is a cross-site scripting (XSS) flaw in ansi2html's OSC 8 hyperlink handling code. The root cause is insufficient input validation and output escaping of URL targets in hyperlinks generated from ANSI escape sequences. Attackers can inject javascript: URI schemes or craft malformed href attributes to bypass the library's sanitization, achieving arbitrary JavaScript execution in the context of pages displaying the converted output. The vulnerability affects versions 1.7.0a0 through 1.9.3, and the attack requires only the ability to control ANSI-encoded text input—no authentication or special preconditions are required. Patches are expected to properly escape URL schemes and validate hyperlink targets.
Affected products
- pycontribs ansi2html 1.7.0a0 through 1.9.3
Timeline
- 2026-09-17: disclosed