CVE-2026-84683

*** Pendiente de traducción *** A flaw was found in Red Hat Ansible Automation Platform&amp;#39;s automation-<br /> controller. The HTML view of job, ad hoc command, project update, and inventory<br /> update standard output escapes HTML metacharacters but does not remove ANSI<br /> terminal escape sequences before conversion to HTML. An ANSI OSC 8 hyperlink<br /> sequence in the output is expanded into an HTML anchor whose href is not scheme-<br /> filtered or escaped, so a low-privileged user who can produce output -- or an<br /> external party whose data a playbook echoes -- can embed a javascript: link that<br /> is rendered into a text/html response with no Content-Security-Policy. When a<br /> higher-privileged user views the output page and clicks the link, attacker-<br /> controlled JavaScript executes in their authenticated session, allowing actions<br /> as that user up to full platform takeover.