CVE-2026-40470 - Vulnerability Analysis

Overview

hackage-server and hackage.haskell.org contain a stored XSS caused by serving HTML and JavaScript files from source packages or documentation upload as-is, letting attackers hijack user sessions and perform authorized actions, exploit requires user to have latent HTTP credentials and visit malicious package pages.

Severity & Score

Impact

Attackers can hijack user sessions to upload packages, modify metadata, or perform any authorized user actions.

Mitigation

Update to the latest version of hackage-server that sanitizes served content.

References

• https://osv.dev/vulnerability/HSEC-2024-0004

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner