HSEC-2024-0001
Reflected XSS vulnerability in keter
Reflected XSS vulnerability in keter
Keter is an app-server/reverse-proxy often used with webapps build on Yesod web-framework.
In the logic handling VHost dispatch, Keter was echoing back Host header value, unescaped,
as part of an HTML error page. This constitutes a reflected-XSS vulnerability. Although
not readily exploitable directly from a browser (where Host header can't generally assume
arbitrary values), it may become such in presence of further weaknesses in components
upstream of Keter in the http proxying chain. Therefore, AC:High in CVSS evaluation.
What each source reports
OSV No score
Reflected XSS vulnerability in keter
Reflected XSS vulnerability in keter
Keter is an app-server/reverse-proxy often used with webapps build on Yesod web-framework.
In the logic handling VHost dispatch, Keter was echoing back Host header value, unescaped,
as part of an HTML error page. This constitutes a reflected-XSS vulnerability. Although
not readily exploitable directly from a browser (where Host header can't generally assume
arbitrary values), it may become such in presence of further weaknesses in components
upstream of Keter in the http proxying chain. Therefore, AC:High in CVSS evaluation.
- Record
HSEC-2024-0001- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
keterHackage |
0.3.4 up to 1.8.4, plus listed versions 0.3.4.10.3.4.20.3.50.3.5.10.3.5.2 Show 44 moreShow less0.3.5.30.3.5.40.3.60.3.6.10.4.01.0.11.0.1.11.0.1.21.1.01.1.0.11.2.01.2.11.3.01.3.11.3.101.3.10.11.3.21.3.31.3.41.3.51.3.5.11.3.5.21.3.5.31.3.61.3.71.3.7.11.3.81.3.91.3.9.11.3.9.21.4.01.4.0.11.4.11.4.2.11.4.31.4.3.11.4.3.21.51.61.71.81.8.11.8.21.8.3 |
1.8.4 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
HSEC-2024-0001 is a vulnerability with no CVSS score yet in keter, published November 14, 2025. No source lists public exploit code. Fixed in keter 1.8.4.