Sourcehut account takeover via build logs (XSS in ansi2html)

What happened

A wormable vulnerability allowed anyone able to inject text in a build log on builds.sr.ht (or other instances) to take over accounts who viewed them

Summary assembled by rule from the sources below

Timeline

1. 19:54
   First appeared on Hacker NewsHHacker News
2. 20:38
   Discussion started on LobstersLLobsters

Sources