CVE-2026-92973 in ansi2html
Summary
by MITRE • 09/17/2026
ansi2html versions 1.7.0a0 through 1.9.3 contain a cross-site scripting vulnerability in OSC 8 hyperlink handling that fails to validate or escape URL targets. Attackers controlling ANSI text input can inject javascript: schemes or terminate href attributes to execute arbitrary scripts in the context of pages displaying converted output.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/17/2026
The ansi2html utility, specifically versions ranging from 1.7.0a0 through 1.9.3, contains a critical cross-site scripting vulnerability within its handling of OSC 8 hyperlink sequences. This component is designed to convert ANSI escape codes into HTML format for display in web browsers or terminal emulators that support rich text rendering. The core technical flaw lies in the failure to properly validate or sanitize URL targets extracted from these escape sequences before embedding them into the resulting HTML anchor tags. When an attacker controls the input stream containing ANSI text, they can craft malicious OSC 8 sequences that embed dangerous payloads directly into the href attribute of generated hyperlinks. This lack of sanitization allows for two primary attack vectors: injecting javascript: URI schemes or terminating existing attributes to inject arbitrary script blocks.
In a typical exploitation scenario, an attacker might provide input such as text containing an escape sequence like ESC ] 8 ; id=1;http://example.com\x07 followed by malicious content, but more critically, they can manipulate the URL field itself. By injecting javascript:alert(document.cookie) or similar payloads into the target URL portion of the OSC 8 command, the resulting HTML will contain an anchor tag with a href attribute set to this malicious script URI. When a user interacts with this link by clicking it, the browser executes the JavaScript code within the context of the current page domain. Alternatively, attackers can exploit string termination vulnerabilities in the parsing logic to break out of the intended attribute scope, potentially injecting event handlers or other HTML elements that trigger script execution upon rendering or interaction.
The operational impact of this vulnerability is significant for any application or service that processes untrusted ANSI text and converts it to HTML for display. This includes web-based terminal emulators, log viewers, chat applications with rich text support, and documentation generators. If a user views content containing these malicious escape sequences in a browser context where the ansi2html output is rendered, they are susceptible to session hijacking, credential theft, defacement of the application interface, or redirection to phishing sites. The attack relies on social engineering or automated injection into input fields that accept ANSI-formatted text, making it particularly dangerous in collaborative environments or public-facing platforms where user-generated content is displayed without sufficient sanitization layers between the conversion tool and the final HTML output.
This vulnerability aligns with CWE-79, which classifies improper neutralization of input during web page generation as a cross-site scripting weakness. From an offensive security perspective, this maps to MITRE ATT&CK technique T1059.007, specifically JavaScript execution via browser-based attacks. The root cause is identified as CWE-20, indicating insufficient input validation and sanitization mechanisms within the parsing logic of the OSC 8 handler. To mitigate this risk, developers should implement strict allow-listing for URL schemes permitted in hyperlink targets, ensuring that only safe protocols such as http or https are accepted while explicitly blocking javascript:, data:, vbscript:, and other executable URI schemes. Additionally, applying context-aware output encoding to all user-supplied values before embedding them into HTML attributes is essential. Upgrading to a patched version of ansi2html where these sanitization checks have been implemented is the primary remediation strategy for existing deployments.