A wormable Cross-Site Scripting vulnerability in the ansi2html component of Sourcehut allowed attackers to hijack user accounts through malicious build logs. The exploit automatically compromised the accounts of anyone who viewed an infected log on the Sourcehut build service or other platform instances.