{"id":"HSEC-2025-0005","aliases":[],"status":"published","title":"cabal-install dependency confusion","description":"# `cabal-install` dependency confusion\n\nFor **cabal-install \u003c 3.4.0.0** and where multiple repositories are\nconfigured, the resolver picks the highest available version across\nall repositories.  Where a package is only defined in a private\nrepository, this behaviour leads to a [*dependency confusion*][blog]\nsupply chain vulnerability.  If the private package name becomes\nknown, a malicious actor can claim the name in the public repository\nand publish a malicious version at a higher version number.\n\nDefault `cabal-install` configurations that only use the\n`hackage.haskell.org` repository are not affected.  Configurations\nthat use curated private repositories **exclusively** are also not\naffected.\n\n[blog]: https://frasertweedale.github.io/blog-fp/posts/2021-02-12-haskell-dependency-confusion.html\n\n\n## Mitigations\n\n*cabal-install* version **3.4.0.0** and higher provide an `override`\noption in the repository configuration.  It marks the associated\nrepository as canonical for all packages defined in that repository.\nNo other repositories will be considered.  For example:\n\n```\n-- For packages in repo.example.com,\n-- only versions in repo.example.com are considered\nactive-repositories:\n  , hackage.haskell.org\n  , repo.example.com:override\n```\n\nUsers and organisations using private repositories that contain\nprivate packages in addition to public repositories **MUST** use the\n`override` option to prevent dependency confusion attacks.\n\nAlternatively, projects and organisations can run a private instance\nof *hackage-server* and carefully curate and review its contents.\nUsing that instance exclusively defeats supply chain attacks\nincluding *dependency confusion*.  For *cabal-install \u003c 3.4* and\nwhere using multiple repositories, this is the only effective\nmitigation against dependency confusion attacks.","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2025-11-14T14:45:34Z","modified":"2025-11-14T18:15:46Z","fixes":[{"ecosystem":"Hackage","package":"cabal-install","fixed_in":["3.4.0.0"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Hackage","package":"cabal-install","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0.0"},{"fixed":"3.4.0.0"}]}],"versions":["1.16.0","1.16.0.1","1.16.0.2","1.16.1.0","1.18.0","1.18.0.1","1.18.0.2","1.18.0.3","1.18.0.4","1.18.0.5","1.18.0.6","1.18.0.7","1.18.0.8","1.18.1.0","1.18.2.0","1.20.0.0","1.20.0.1","1.20.0.2","1.20.0.3","1.20.0.4","1.20.0.5","1.20.0.6","1.20.1.0","1.20.2.0","1.22.0.0","1.22.0.1","1.22.2.0","1.22.3.0","1.22.4.0","1.22.5.0","1.22.6.0","1.22.7.0","1.22.8.0","1.22.9.0","1.24.0.0","1.24.0.1","1.24.0.2","2.0.0.0","2.0.0.1","2.2.0.0","2.4.0.0","2.4.1.0","3.0.0.0","3.2.0.0"]}],"references":[{"url":"https://frasertweedale.github.io/blog-fp/posts/2021-02-12-haskell-dependency-confusion.html","tags":["report"]}],"sources":{"osv":[{"id":"HSEC-2025-0005","title":"cabal-install dependency confusion","description":"# `cabal-install` dependency confusion\n\nFor **cabal-install \u003c 3.4.0.0** and where multiple repositories are\nconfigured, the resolver picks the highest available version across\nall repositories.  Where a package is only defined in a private\nrepository, this behaviour leads to a [*dependency confusion*][blog]\nsupply chain vulnerability.  If the private package name becomes\nknown, a malicious actor can claim the name in the public repository\nand publish a malicious version at a higher version number.\n\nDefault `cabal-install` configurations that only use the\n`hackage.haskell.org` repository are not affected.  Configurations\nthat use curated private repositories **exclusively** are also not\naffected.\n\n[blog]: https://frasertweedale.github.io/blog-fp/posts/2021-02-12-haskell-dependency-confusion.html\n\n\n## Mitigations\n\n*cabal-install* version **3.4.0.0** and higher provide an `override`\noption in the repository configuration.  It marks the associated\nrepository as canonical for all packages defined in that repository.\nNo other repositories will be considered.  For example:\n\n```\n-- For packages in repo.example.com,\n-- only versions in repo.example.com are considered\nactive-repositories:\n  , hackage.haskell.org\n  , repo.example.com:override\n```\n\nUsers and organisations using private repositories that contain\nprivate packages in addition to public repositories **MUST** use the\n`override` option to prevent dependency confusion attacks.\n\nAlternatively, projects and organisations can run a private instance\nof *hackage-server* and carefully curate and review its contents.\nUsing that instance exclusively defeats supply chain attacks\nincluding *dependency confusion*.  For *cabal-install \u003c 3.4* and\nwhere using multiple repositories, this is the only effective\nmitigation against dependency confusion attacks.\n","status":"published","published":"2025-11-14T14:45:34Z","modified":"2025-11-14T18:15:46.044845Z","updated_at":"2026-11-02T15:47:17.805107Z"}]}}