High priorityDisclosed

Advisory · CVE-2026-84683

ANSI hyperlink injection turns AAP job output into session hijack

The automation controller's job output view expands ANSI OSC 8 hyperlinks into clickable anchors without filtering schemes, letting a low-privilege user plant javascript: links that execute in a higher-privileged viewer's session.

Advisory published September 23, 2026Independent summary
Vendor
Red Hat
Product
Red Hat Ansible Automation Platform 2
Identifier / CWE
CVE-2026-84683
CWE-79
Action timing
Immediate
ELI5

Explain it like I’m five

The job results page shows terminal colors and clickable links, but it never checks where the links point. A prankster hides a booby-trapped link in the job output, and when the boss clicks it, the prankster gets to drive the boss's account.

SIMPLIFIED_ATTACK_PATH04 STEPS
  1. 01Poisoned output

    A low-privilege user produces job output containing an ANSI OSC 8 hyperlink sequence, or a playbook echoes attacker-controlled external data.

  2. 02Unfiltered anchor

    The HTML view of the output expands the sequence into an HTML anchor without scheme filtering or escaping, served as text/html with no Content-Security-Policy.

  3. 03Privileged click

    A higher-privileged user opens the job output page and clicks the rendered link.

  4. 04Session takeover

    Attacker-controlled JavaScript executes in the victim's authenticated session, enabling actions as that user up to full platform takeover.

What happened

The automation controller’s HTML rendering of job, ad hoc command, project update, and inventory update output escapes HTML metacharacters but does not strip ANSI terminal escape sequences before converting to HTML. An ANSI OSC 8 hyperlink sequence in the output becomes an HTML anchor whose href is not scheme-filtered or escaped, so javascript: links survive into a text/html response with no Content-Security-Policy. A low-privilege user who can influence output, or external data a playbook echoes, can plant a link that executes JavaScript in the session of any higher-privileged user who clicks it.

Red Hat reports Red Hat Ansible Automation Platform 2 as affected and rates the issue high at CVSS 8.7. Red Hat has not stated a fixed version in the data available, so remediation should follow the vendor bulletin.

What to do

  1. Follow the Red Hat security bulletin for patches or mitigations and apply them.
  2. Warn platform administrators to treat links inside job output views as untrusted until patched.
  3. Audit job outputs that were viewed by administrators for embedded hyperlink sequences.
  4. Consider limiting who can produce output in jobs whose results administrators routinely review.
  5. Review controller access logs for sessions that performed unusual administrative actions after viewing job output.

Management note

Stored XSS that climbs the privilege ladder is one of the nastiest shapes in a management console, because the victim does everything right and the platform betrays them. The immediate control is behavioral: do not click links in job output. The real fix is output sanitization from the vendor.