Description
A critical XSS vulnerability affected hackage-server and
hackage.haskell.org. HTML and JavaScript files provided in source
packages or via the documentation upload facility were served
as-is on the main hackage.haskell.org domain. As a consequence,
when a user with latent HTTP credentials browses to the package
pages or documentation uploaded by a malicious package maintainer,
their session can be hijacked to upload packages or
documentation, amend maintainers or other package metadata, or
perform any other action the user is authorised to do.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | hackage-server | 0.1 – < 0.6 | 0.6 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Hackage | hackage-server | >= 0.1, < 0.6 | 0.6 | HSEC-2024-0004 |