CVE-2026-92973: ansi2html 1.7.0a0 through 1.9.3 Cross-Site Scripting via OSC 8

Severity: medium (CVSS 6.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-09-17 · updated 2026-09-23
Weakness: CWE-79

Description

ansi2html versions 1.7.0a0 through 1.9.3 contain a cross-site scripting vulnerability in OSC 8 hyperlink handling that fails to validate or escape URL targets. Attackers controlling ANSI text input can inject javascript: schemes or terminate href attributes to execute arbitrary scripts in the context of pages displaying converted output.

Affected products

pycontribs ansi2html: from 1.7.0a0 before 1.9.4 — fixed in 1.9.4

How to fix

Upgrade to a fixed version: pycontribs ansi2html 1.9.4. Check the vendor advisory for mitigations.

References

https://github.com/pycontribs/ansi2html
https://github.com/pycontribs/ansi2html/blob/v1.9.3/src/ansi2html/converter.py#L345-L349
https://github.com/pycontribs/ansi2html/commit/89d1c231c60ac52005f3b21bbba551c786c554fc
https://www.vulncheck.com/advisories/ansi2html-1.7-0a0-through-1.9.3-cross-site-scripting-via-osc-8

Get alerted when CVE-2026-92973 or the next vulnerability affects your stack