CVE catalog

CVE-2026-92973

UBUNTU-CVE-2026-92973

[CVE catalog]

Severity
Medium · CVSS 6.1CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Published
Updated
Source
[NVD] · [CVE record]
EPSS
0.39% · Oct 25, 2026

ansi2html versions 1.7.0a0 through 1.9.3 contain a cross-site scripting vulnerability in OSC 8 hyperlink handling that fails to validate or escape URL targets. Attackers controlling ANSI text input can inject javascript: schemes or terminate href attributes to execute arbitrary scripts in the context of pages displaying converted output.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianpython-ansi2html141.9.2-1vulnerable
Debianpython-ansi2html141.9.2-2vulnerable
Debianpython-ansi2html141.9.5-1fixed
Opensusepython-ansi2htmltumbleweed1.9.5-1.1fixed
Ubuntupython-ansi2html26.101.9.2-2vulnerable
Ubuntupython-ansi2html26.041.9.2-1vulnerable
Ubuntupython-ansi2html26.041.9.2-2vulnerable

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianpython-ansi2htmldeb141.9.5-1Not reportedDEBIAN-CVE-2026-92973Not reported
Opensusepython-ansi2htmlrpmtumbleweed1.9.5-1.1Not reportedOPENSUSE-SU-2026:11815-1Not reported

OpenFactory catalog packages

[openSUSE Tumbleweed]

  • [python313-ansi2html]Unknown

    Source package: [python-ansi2html]

    Details (1)

    • 1.9.2-3.4 · noarch · tumbleweed

      Unknown · Fixed: 1.9.5-1.1

      Version impact unknown

      pypi · python-ansi2html · opensuse · tumbleweed

  • [python314-ansi2html]Unknown

    Source package: [python-ansi2html]

    Details (1)

    • 1.9.2-3.4 · noarch · tumbleweed

      Unknown · Fixed: 1.9.5-1.1

      Version impact unknown

      pypi · python-ansi2html · opensuse · tumbleweed

Observed:

References

[FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]