The vulnerability in Red Hat Ansible Automation Platform 2.6 for RHEL 9 involves improper neutralization of input during web page generation. Specifically, ANSI OSC 8 hyperlink sequences in standard output are expanded into HTML anchors without filtering or escaping the href attribute's scheme. This enables a low-privileged user or an external party whose data is echoed by a playbook to inject a javascript: link. When a higher-privileged user views the output and clicks the link, attacker-controlled JavaScript executes with that user's privileges, allowing actions up to full platform compromise.

Successful exploitation allows an attacker with low privileges to execute arbitrary JavaScript in the context of a higher-privileged user's session. This can lead to unauthorized actions within the platform, including full takeover. The CVSS 3.1 base score is 8.7 (high severity), reflecting network attack vector, low attack complexity, required privileges, user interaction, and high impact on confidentiality and integrity.

An official security update is available from Red Hat addressing this vulnerability as part of Red Hat Ansible Automation Platform 2.6 updates. Users should apply the update referenced in Red Hat Advisory RHSA-2026:71113 promptly to remediate this issue. No additional mitigation steps are required beyond applying the official patch.