CVE-2026-92973

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-92973", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-09-17T13:24:03.383Z", "datePublished": "2026-09-17T13:43:17.365Z", "dateUpdated": "2026-09-17T15:38:41.098Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-09-17T13:43:17.365Z"}, "datePublic": "2026-08-31T00:00:00.000Z", "title": "ansi2html 1.7.0a0 through 1.9.3 Cross-Site Scripting via OSC 8", "descriptions": [{"lang": "en", "value": "ansi2html versions 1.7.0a0 through 1.9.3 contain a cross-site scripting vulnerability in OSC 8 hyperlink handling that fails to validate or escape URL targets. Attackers controlling ANSI text input can inject javascript: schemes or terminate href attributes to execute arbitrary scripts in the context of pages displaying converted output."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "affected": [{"vendor": "pycontribs", "product": "ansi2html", "defaultStatus": "unaffected", "packageURL": "pkg:pypi/ansi2html", "versions": [{"version": "1.7.0a0", "lessThan": "1.9.4", "status": "affected", "versionType": "custom"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:ansi2html_project:ansi2html:*:*:*:*:*:*:*:*", "versionStartIncluding": "1.7.0a0", "versionEndExcluding": "1.9.4"}]}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N", "attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "PASSIVE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "LOW", "subAvailabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM"}}, {"format": "CVSS", "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "CHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM"}}], "references": [{"url": "https://github.com/pycontribs/ansi2html/commit/89d1c231c60ac52005f3b21bbba551c786c554fc", "tags": ["patch"], "name": "Patch Commit"}, {"url": "https://github.com/pycontribs/ansi2html/blob/v1.9.3/src/ansi2html/converter.py#L345-L349", "tags": ["technical-description"]}, {"url": "https://github.com/pycontribs/ansi2html", "tags": ["product"]}, {"name": "VulnCheck Advisory: ansi2html 1.7.0a0 through 1.9.3 Cross-Site Scripting via OSC 8", "tags": ["third-party-advisory"], "url": "https://www.vulncheck.com/advisories/ansi2html-1.7-0a0-through-1.9.3-cross-site-scripting-via-osc-8"}], "credits": [{"lang": "en", "value": "Arkadiusz Kozdra", "type": "finder"}], "x_generator": {"engine": "vulncheck-endgame"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-09-17T15:38:31.834465Z", "id": "CVE-2026-92973", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-17T15:38:41.098Z"}}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-92973", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-09-17T13:24:03.383Z", "datePublished": "2026-09-17T13:43:17.365Z", "dateUpdated": "2026-09-17T15:38:41.098Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-09-17T13:43:17.365Z"}, "datePublic": "2026-08-31T00:00:00.000Z", "title": "ansi2html 1.7.0a0 through 1.9.3 Cross-Site Scripting via OSC 8", "descriptions": [{"lang": "en", "value": "ansi2html versions 1.7.0a0 through 1.9.3 contain a cross-site scripting vulnerability in OSC 8 hyperlink handling that fails to validate or escape URL targets. Attackers controlling ANSI text input can inject javascript: schemes or terminate href attributes to execute arbitrary scripts in the context of pages displaying converted output."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "affected": [{"vendor": "pycontribs", "product": "ansi2html", "defaultStatus": "unaffected", "packageURL": "pkg:pypi/ansi2html", "versions": [{"version": "1.7.0a0", "lessThan": "1.9.4", "status": "affected", "versionType": "custom"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:ansi2html_project:ansi2html:*:*:*:*:*:*:*:*", "versionStartIncluding": "1.7.0a0", "versionEndExcluding": "1.9.4"}]}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N", "attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "PASSIVE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "LOW", "subAvailabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM"}}, {"format": "CVSS", "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "CHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM"}}], "references": [{"url": "https://github.com/pycontribs/ansi2html/commit/89d1c231c60ac52005f3b21bbba551c786c554fc", "tags": ["patch"], "name": "Patch Commit"}, {"url": "https://github.com/pycontribs/ansi2html/blob/v1.9.3/src/ansi2html/converter.py#L345-L349", "tags": ["technical-description"]}, {"url": "https://github.com/pycontribs/ansi2html", "tags": ["product"]}, {"name": "VulnCheck Advisory: ansi2html 1.7.0a0 through 1.9.3 Cross-Site Scripting via OSC 8", "tags": ["third-party-advisory"], "url": "https://www.vulncheck.com/advisories/ansi2html-1.7-0a0-through-1.9.3-cross-site-scripting-via-osc-8"}], "credits": [{"lang": "en", "value": "Arkadiusz Kozdra", "type": "finder"}], "x_generator": {"engine": "vulncheck-endgame"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-92973", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-09-17T15:38:31.834465Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-17T15:38:36.924Z"}}]}}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "packageURL": "pkg:pypi/ansi2html", "product": "ansi2html", "vendor": "pycontribs", "versions": [{"lessThan": "1.9.4", "status": "affected", "version": "1.7.0a0", "versionType": "custom"}]}], "source": "disclosure@vulncheck.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "ansi2html versions 1.7.0a0 through 1.9.3 contain a cross-site scripting vulnerability in OSC 8 hyperlink handling that fails to validate or escape URL targets. Attackers controlling ANSI text input can inject javascript: schemes or terminate href attributes to execute arbitrary scripts in the context of pages displaying converted output."}], "id": "CVE-2026-92973", "lastModified": "2026-09-23T17:17:44.907", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "LOW", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-92973", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-09-17T15:38:31.834465Z", "version": "2.0.3"}}]}, "published": "2026-09-17T14:18:03.507", "references": [{"source": "disclosure@vulncheck.com", "url": "https://github.com/pycontribs/ansi2html"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/pycontribs/ansi2html/blob/v1.9.3/src/ansi2html/converter.py#L345-L349"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/pycontribs/ansi2html/commit/89d1c231c60ac52005f3b21bbba551c786c554fc"}, {"source": "disclosure@vulncheck.com", "url": "https://www.vulncheck.com/advisories/ansi2html-1.7-0a0-through-1.9.3-cross-site-scripting-via-osc-8"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "disclosure@vulncheck.com", "type": "Secondary"}]}

{"bugzilla": {"description": "ansi2html: ansi2html: Cross-Site Scripting via OSC 8 hyperlink handling", "id": "2536059", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2536059"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.1", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "status": "draft"}, "cwe": "CWE-79", "details": ["A flaw was found in ansi2html. This cross-site scripting (XSS) vulnerability exists in the OSC 8 hyperlink handling, where the component fails to properly validate or escape URL targets. A remote attacker, by controlling ANSI text input, can inject malicious JavaScript schemes or manipulate href attributes. This allows for the execution of arbitrary scripts within the context of web pages displaying the converted output, potentially leading to information disclosure or other client-side attacks."], "name": "CVE-2026-92973", "public_date": "2026-09-17T13:43:17Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-92973\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-92973\nhttps://github.com/pycontribs/ansi2html\nhttps://github.com/pycontribs/ansi2html/blob/v1.9.3/src/ansi2html/converter.py#L345-L349\nhttps://github.com/pycontribs/ansi2html/commit/89d1c231c60ac52005f3b21bbba551c786c554fc\nhttps://www.vulncheck.com/advisories/ansi2html-1.7-0a0-through-1.9.3-cross-site-scripting-via-osc-8"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": null}], "enrichment": {"confidence": 100.0, "confidence_source": "inferred", "scores": [{"score": 100.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "ansi2html", "vendor": "ansi2html_project"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[1.7.0a0,1.9.4)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "ansi2html", "source": "cna", "vendor": "pycontribs"}, "product": "ansi2html", "vendor": "pycontribs"}], "created": "2026-09-17T19:49:42.519815+00:00", "updated": "2026-09-17T21:30:18.276709+00:00", "vendors": ["ansi2html_project", "ansi2html_project$PRODUCT$ansi2html", "pycontribs", "pycontribs$PRODUCT$ansi2html"]}