Skip to content
OpenAdvisories

Package · Hackage

hackage-server

3 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Feed

  • Critical 9.9
    CVE-2026-40472

    Hackage package metadata stored XSS vulnerability

    In hackage-server, user-controlled metadata from .cabal files are rendered into HTML href attributes without proper sanitization, enabling stored Cross-Site Scripting (XSS) attacks.

    hackage-server Hackage
  • Critical 9.6
    CVE-2026-40471

    Hackage CSRF vulnerability

    hackage-server lacked Cross-Site Request Forgery (CSRF) protection across its endpoints. Scripts on foreign sites could trigger requests to hackage server, possibly abusing latent credentials to upload packages or perform other administrative actions. Some un…

    hackage-server Hackage
  • Critical 9.9
    CVE-2026-40470

    Hackage package and doc upload stored XSS vulnerability

    A critical XSS vulnerability affected hackage-server and hackage.haskell.org. HTML and JavaScript files provided in source packages or via the documentation upload facility were served as-is on the main hackage.haskell.org domain. As a consequence, when a use…

    hackage-server Hackage