A vulnerability in Red Hat Ansible Automation Platform's automation-controller allows low-privileged users to embed malicious JavaScript links in job output. The platform's HTML view escapes HTML metacharacters but fails to remove ANSI terminal escape sequences, enabling an attacker to inject javascript: links. When a higher-privileged user views and clicks such a link, attacker-controlled JavaScript executes in their authenticated session, potentially leading to full platform takeover.