CVE-2026-40472
Hackage package metadata stored XSS vulnerability
In hackage-server, user-controlled metadata from .cabal files are rendered into HTML href attributes without proper sanitization, enabling stored Cross-Site Scripting (XSS) attacks.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
Hackage package metadata stored XSS vulnerability
In hackage-server, user-controlled metadata from .cabal files are rendered into HTML href attributes without proper sanitization, enabling stored Cross-Site Scripting (XSS) attacks.
- Record
CVE-2026-40472- CVSS 3.1
- 9.9 Critical
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L - Weakness
- CWE-79
- Updated
- 2026-11-02
EUVDEUVD-2026-25235
In hackage-server, user-controlled metadata from .cabal files are rendered into HTML href attributes without proper sanitization, enabling stored Cross-Site Scripting (XSS) attacks.
- Record
EUVD-2026-25235- CVSS 3.1
- 9.9 Critical
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-8fw8-47cx-j4q4
In hackage-server, user-controlled metadata from .cabal files are rendered into HTML href...
In hackage-server, user-controlled metadata from .cabal files are rendered into HTML href attributes without proper sanitization, enabling stored Cross-Site Scripting (XSS) attacks.
- Record
GHSA-8fw8-47cx-j4q4- CVSS 3.1
- 9.9 Critical
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L - Weakness
- CWE-79
- Updated
- 2026-11-02
NVD
In hackage-server, user-controlled metadata from .cabal files are rendered into HTML href attributes without proper sanitization, enabling stored Cross-Site Scripting (XSS) attacks.
- Record
CVE-2026-40472- CVSS 3.1
- 9.9 Critical
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L - Weakness
- CWE-79
- Updated
- 2026-11-02
OSVHSEC-2026-0004 No score
Hackage package metadata stored XSS vulnerability
Hackage package metadata stored XSS vulnerability
User-controlled metadata from .cabal files are rendered into HTML
href attributes without proper sanitization, enabling stored
Cross-Site Scripting (XSS) attacks. The specific fields affected
are:
homepagebug-reportssource-repository.locationdescription(Haddock hyperlinks)
The Haskell Security Response Team audited the entire corpus of
published packages on hackage.haskell.org—all published
package versions but not candidates. No exploitation attempts
were detected.
To fix the issue, hackage-server now inspects target URIs and only
produces a hyperlink when the URI has an approved scheme: http,
https, and (only for some fields) mailto.
The fix has been committed and deployed on
hackage.haskell.org. Other operations of hackage-server
instances should update as soon as possible to commit
2de3ae45082f8f3f29a41f6aff620d09d0e74058 or later.
Acknowledgements
- Joshua Rogers (https://joshua.hu/) of AISLE (https://aisle.com/) reported the issue to the Haskell Security Response Team.
- Fraser Tweedale implemented the fix.
- Gershom Bazerman merged the fix and deployed it to
hackage.haskell.org.
- Record
HSEC-2026-0004- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
hackage-serverHackage |
0.1 and later, plus listed versions 0.40.5.0 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-40472 is a critical vulnerability (CVSS 9.9) in hackage-server, published March 28, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.30%, the 23rd percentile. No source names a fixed version.