CVE-2026-40472
Hackage package metadata stored XSS vulnerability
Published Mar 28, 2026 · updated Jun 17, 2026
# Hackage package metadata stored XSS vulnerability User-controlled metadata from files are rendered into HTML attributes without proper sanitization, enabling stored Cross-Site Scripting (XSS) attacks. The specific fields affected are: - - - - (Haddock hyperlinks) The Haskell Security Response Team audited the entire corpus of **published** packages on —all published package versions but *not* candidates. No exploitation attempts were detected. To fix the issue, *hackage-server* now inspects target URIs and only produces a hyperlink when the URI has an approved scheme: , , and (only for some fields) . The fix has been [committed][commit] and deployed on . Other operations of *hackage-server* instances should update as soon as possible to commit or later. ## Acknowledgements - **Joshua Rogers** (https://joshua.hu/) of AISLE (https://aisle.com/) reported the issue to the Haskell Security Response Team. - **Fraser Tweedale** implemented the fix. - **Gershom Bazerman** merged the fix and deployed it to . [commit]: https://github.com/haskell/hackage-server/commit/2de3ae45082f8f3f29a41f6aff620d09d0e74058
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
Mar 28, 2026 · OSV.dev
Detected
# Hackage package metadata stored XSS vulnerability User-controlled metadata from files are rendered into HTML attributes without proper sanitization, enabling stored Cross-Site Scripting (XSS) attacks. The specific fields affected are: - - - - (Haddock hyperlinks) The Haskell Security Response Team audited the entire corpus of **published** packages on —all published package versions but *not* ca
Apr 14, 2026 · OSV.dev
Updated
# Hackage package metadata stored XSS vulnerability User-controlled metadata from files are rendered into HTML attributes without proper sanitization, enabling stored Cross-Site Scripting (XSS) attacks. The specific fields affected are: - - - - (Haddock hyperlinks) The Haskell Security Response Team audited the entire corpus of **published** packages on —all published package versions but *not* ca
Jun 17, 2026 · NIST NVD
Updated
In hackage-server, user-controlled metadata from .cabal files are rendered into HTML href attributes without proper sanitization, enabling stored Cross-Site Scripting (XSS) attacks.
Affected
- Hackage hackage-server0.4, 0.5.0
Sources
- CVE.orgVulnerability recordCVE-2026-40472
Official CVE identifier
cve.org - NIST NVDVulnerability recordCVE-2026-40472
In hackage-server, user-controlled metadata from .cabal files are rendered into HTML href attributes without proper sanitization, enabling stored Cross-Site Scripting (XSS) attacks.
nvd.nist.gov - OSV.devPackage advisoryHSEC-2026-0004
Hackage package metadata stored XSS vulnerability
osv.dev