Skip to content
OpenAdvisories

Ecosystem

Hackage

36 known vulnerabilities.

Most affected packages

git-annex 5 hackage-server 3 aeson 2 biscuit-haskell 2 x509-validation 2 base 2 cabal-install 2 scientific 2 xmonad-contrib 1 xml-conduit 1 tls-extra 1 toml-reader 1 hledger-web 1 pandoc 1 keter 1 bzlib 1 bz2 1 bzlib-conduit 1 process 1 cryptonite 1 crypton 1 xz-clib 1 spacecookie 1 x509-store 1 crypton-x509-store 1 cmark-gfm 1 Cabal 1 text-iso8601 1 crypton-x509-validation 1 crypton-x509 1 x509 1 jwt 1 warp 1
All Critical High Medium Low Exploited only Public exploit

7 results · Clear filters · Feed

  • Critical 9.1
    CVE-2026-9648

    CVE-2026-9648

    The crypton-x509-validation Haskell library fails to enforce X.509 NameConstraints, allowing TLS clients to accept certificates whose Subject Alternative Names fall outside the issuing CA’s permitted subtrees. This oversight enables an attacker who compromise…

    Haskell Programming Language crypton-certificate x509-validation haskell-crypton-x509-validation Debian Ubuntu Hackage
  • Critical 9.9
    CVE-2026-40472

    Hackage package metadata stored XSS vulnerability

    In hackage-server, user-controlled metadata from .cabal files are rendered into HTML href attributes without proper sanitization, enabling stored Cross-Site Scripting (XSS) attacks.

    hackage-server Hackage
  • Critical 9.6
    CVE-2026-40471

    Hackage CSRF vulnerability

    hackage-server lacked Cross-Site Request Forgery (CSRF) protection across its endpoints. Scripts on foreign sites could trigger requests to hackage server, possibly abusing latent credentials to upload packages or perform other administrative actions. Some un…

    hackage-server Hackage
  • Critical 9.9
    CVE-2026-40470

    Hackage package and doc upload stored XSS vulnerability

    A critical XSS vulnerability affected hackage-server and hackage.haskell.org. HTML and JavaScript files provided in source packages or via the documentation upload facility were served as-is on the main hackage.haskell.org domain. As a consequence, when a use…

    hackage-server Hackage
  • Critical 9.8
    CVE-2024-3566

    Command injection vulnerability in programing languages on Microsoft Windows operating system.

    A command inject vulnerability allows an attacker to perform command injection on Windows applications that indirectly depend on the CreateProcess function when the specific conditions are satisfied.

    Node.js Haskell Programming Language Go Programming Language Node.js Hackage
  • Critical 9.8
    CVE-2022-31053

    Signature forgery in Biscuit

    Biscuit is an authentication and authorization token for microservices architectures. The Biscuit specification version 1 contains a vulnerable algorithm that allows malicious actors to forge valid Γ-signatures. Such an attack would allow an attacker to creat…

    biscuit-auth biscuit biscuit-auth biscuit-haskell Maven Go crates.io Hackage
  • Critical 9.8
    CVE-2019-12900

    out-of-bounds write when there are many bzip2 selectors

    BZ2_decompress in decompress.c in bzip2 through 1.0.6 has an out-of-bounds write when there are many selectors.

    clamav clamav bzip2 bzip2 Debian Ubuntu Alpine Hackage