Cross-Site Scripting Vulnerability in ansi2html by PyContribs
CVE-2026-92973

5.3MEDIUM

Key Information:

Vendor

Pycontribs

Status
Ansi2html
Vendor
CVE Published:
17 September 2026

What is CVE-2026-92973?

The ansi2html product, versions 1.7.0a0 through 1.9.3, is vulnerable to a cross-site scripting flaw due to improper handling of OSC 8 hyperlinks. This vulnerability allows attackers to exploit unvalidated or non-escaped URL targets in ANSI text input. By injecting malicious javascript schemes or terminating href attributes, attackers can execute arbitrary scripts within the context of the pages that render the converted output, posing a significant security risk to users.

Affected Version(s)

ansi2html 1.7.0a0 < 1.9.4

References

https://github.com/pycontribs/ansi2html/commit/89d1c231c6...
patch
https://github.com/pycontribs/ansi2html/blob/v1.9.3/src/a...
technical-description
https://github.com/pycontribs/ansi2html
product

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Arkadiusz Kozdra
.