Description
In hackage-server, user-controlled metadata from .cabal files are rendered into HTML
href attributes without proper sanitization, enabling stored
Cross-Site Scripting (XSS) attacks.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | hackage-server | 0.1 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Hackage | hackage-server | >= 0.1 | — | HSEC-2026-0004 |