The vulnerability lies in the HTML rendering of job output in Red Hat Ansible Automation Platform 2. While the system escapes HTML special characters, it does not remove ANSI escape codes, including OSC 8 hyperlink sequences. These sequences are translated into raw anchor tags whose href values are not scheme‑filtered or escaped, enabling an attacker to embed a javascript: link in job, ad hoc command, project update, or inventory update output. When a higher‑privileged user opens the output page and clicks the link, the supplied script executes in that user's authenticated session, effectively allowing session hijacking and full platform takeover.

The issue affects all installations of Red Hat Ansible Automation Platform 2 that use the default job output rendering path. Any instance where low‑privileged users can influence the output, or where playbook output is reflected from external sources, is vulnerable. The problem is present across job, ad hoc command, project update, and inventory update views.

With a CVSS score of 8.7 the flaw is rated high severity. The exploit requires an attacker to inject ANSI hyperlink sequences that will be rendered as a javascript: URL. A lower‑privileged user can create or echo such output; a higher‑privileged user then triggers the malicious JavaScript by clicking the link, leading to session takeover and potential full control of the platform. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting no confirmed exploitation yet. Nonetheless, the potential impact mandates urgent remediation.