Sourcehut account takeover via build logs (XSS in ansi2html)

Welcome to my first big impact vulnerability writeup! I like good stories, so let me describe some background first. I recently had a ‘great’ idea (I know, I know, I should stop having these) to set up a sr.ht instance that would pay people for hosting their projects. You can find it shamelessly plugged in the timeline section, in case you want to try it or flame me for it on socials. Anyway, the ...