Description
ansi2html versions 1.7.0a0 through 1.9.3 contain a cross-site scripting vulnerability in OSC 8 hyperlink handling that fails to validate or escape URL targets. Attackers controlling ANSI text input can inject javascript: schemes or terminate href attributes to execute arbitrary scripts in the context of pages displaying converted output.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
pycontribs ansi2html
Default version status: unaffected
1.7.0a0 to < 1.9.4affected
pkg:pypi/ansi2htmlReferences
- https://github.com/pycontribs/ansi2html/commit/89d1c231c60ac52005f3b21bbba551c786c554fc ↗
- https://github.com/pycontribs/ansi2html/blob/v1.9.3/src/ansi2html/converter.py#L345-L349 ↗
- https://github.com/pycontribs/ansi2html ↗
- https://www.vulncheck.com/advisories/ansi2html-1.7-0a0-through-1.9.3-cross-site-scripting-via-osc-8 ↗