CVE-2026-84683 in Ansible Automation Platform
Summary
by MITRE • 09/23/2026
A flaw was found in Red Hat Ansible Automation Platform's automation- controller. The HTML view of job, ad hoc command, project update, and inventory update standard output escapes HTML metacharacters but does not remove ANSI terminal escape sequences before conversion to HTML. An ANSI OSC 8 hyperlink sequence in the output is expanded into an HTML anchor whose href is not scheme- filtered or escaped, so a low-privileged user who can produce output -- or an external party whose data a playbook echoes -- can embed a javascript: link that is rendered into a text/html response with no Content-Security-Policy. When a higher-privileged user views the output page and clicks the link, attacker- controlled JavaScript executes in their authenticated session, allowing actions as that user up to full platform takeover.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/23/2026
The vulnerability identified within Red Hat Ansible Automation Platform's automation-controller component represents a critical server-side input validation failure leading to Cross-Site Scripting (XSS). This flaw specifically affects the HTML rendering of standard output for jobs, ad hoc commands, project updates, and inventory updates. While the system correctly implements basic sanitization by escaping HTML metacharacters such as angle brackets and ampersands, it fails to strip ANSI terminal escape sequences prior to this conversion process. This incomplete sanitization allows specially crafted ANSI codes embedded in command output to persist through the rendering pipeline, creating a pathway for malicious script execution that bypasses standard XSS protections designed to neutralize raw HTML tags.
The core technical mechanism of exploitation relies on the handling of ANSI OSC 8 hyperlink sequences. These escape sequences are interpreted by modern terminal emulators and web browsers as clickable hyperlinks when rendered in an HTML context. The automation-controller expands these ANSI codes into HTML anchor elements but critically fails to apply scheme filtering or proper escaping to the href attribute value. Consequently, if a low-privileged user can generate output containing specific ANSI hyperlink syntax, they can embed a javascript: URI scheme within the link destination. Because the platform does not enforce a Content-Security-Policy header on these text/html responses, there are no additional browser-side restrictions preventing the execution of arbitrary JavaScript code embedded in such links.
The operational impact is severe due to the privilege escalation vector inherent in this design. Although an attacker may only possess low-privileged access or be leveraging data from an external source echoed by a playbook, they can craft output that appears benign until viewed by a higher-privileged administrator. When an authenticated user with elevated privileges views the affected job output page and interacts with the malicious hyperlink, their browser executes the embedded JavaScript within the context of their active session. This allows the attacker to perform actions as the privileged user, potentially leading to full platform takeover, unauthorized configuration changes, data exfiltration, or further lateral movement within the automation infrastructure.
This vulnerability aligns closely with CWE-79, which describes Improper Neutralization of Input During Web Page Generation known as Cross-site Scripting. Specifically, it reflects a failure in output encoding and context-aware validation where only HTML entities are escaped while other dangerous contexts like URI schemes remain unchecked. In terms of the MITRE ATT&CK framework, this exploit maps to T1059 Command and Scripting Interpreter via JavaScript execution within a browser environment, facilitating lateral movement through credential abuse or session hijacking techniques such as T1528 Steal Application Access Token if tokens are accessible via script.
Mitigation strategies must address both immediate remediation and long-term architectural improvements. The primary fix involves updating the automation-controller to strictly filter out ANSI escape sequences before HTML conversion, ensuring that no terminal-specific codes can influence the rendered DOM structure. Additionally, implementing a robust Content-Security-Policy header across all web interfaces is essential to restrict script execution origins and prevent inline scripts from running even if injected. Input validation should be enhanced to detect and reject javascript: URIs in any attribute context, regardless of whether they originate from user input or system logs. Regular security audits focusing on output encoding practices for log viewers and console emulators will help identify similar blind spots where terminal-specific formatting codes might bypass standard web application firewalls or sanitization libraries.