The ansi2html library versions from 1.7.0a0 up to but not including 1.9.4 contain a cross-site scripting vulnerability related to improper neutralization of input during web page generation. Specifically, the OSC 8 hyperlink handling feature does not validate or escape URL targets, enabling attackers controlling ANSI text input to inject javascript: schemes or prematurely terminate href attributes. This flaw allows execution of arbitrary scripts within the security context of pages that render the converted output, potentially leading to client-side code execution.

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of the affected web page, which may lead to session hijacking, defacement, or other client-side attacks. The vulnerability requires the attacker to control the ANSI text input that is converted and displayed, and user interaction (UI) is needed to trigger the malicious script. The CVSS 4.0 base score is 5.3, indicating medium severity with network attack vector, low complexity, no privileges required, and user interaction needed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid processing untrusted ANSI text input with vulnerable versions of ansi2html or implement input validation and sanitization on ANSI text sources to prevent injection of malicious URL schemes.