CVE-2026-40470 (GCVE-0-2026-40470)

Vulnerability from cvelistv5 – Published: 2026-04-23 14:53 – Updated: 2026-04-23 16:22
VLAI?
Title
Hackage package and doc upload stored XSS vulnerability
Summary
A critical XSS vulnerability affected hackage-server and hackage.haskell.org. HTML and JavaScript files provided in source packages or via the documentation upload facility were served as-is on the main hackage.haskell.org domain. As a consequence, when a user with latent HTTP credentials browses to the package pages or documentation uploaded by a malicious package maintainer, their session can be hijacked to upload packages or documentation, amend maintainers or other package metadata, or perform any other action the user is authorised to do.
Severity ?
9.9 (Critical)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L
CWE
  • CWE-79 - Improper neutralization of input during web page generation ('cross-site scripting')
Assigner
References
Impacted products
Vendor Product Version
Affected: 0.1 , < 0.6 (semver)
Date Public ?
2026-01-16 14:18
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-40470",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-04-23T16:19:40.142224Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-04-23T16:22:27.341Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://hackage.haskell.org/package/hackage-server",
          "defaultStatus": "unaffected",
          "packageName": "hackage-server",
          "versions": [
            {
              "lessThan": "0.6",
              "status": "affected",
              "version": "0.1",
              "versionType": "semver"
            }
          ]
        }
      ],
      "datePublic": "2026-01-16T14:18:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "A \u003cstrong\u003ecritical XSS vulnerability\u003c/strong\u003e affected \u003cem\u003ehackage-server\u003c/em\u003e and\n\u003ccode\u003ehackage.haskell.org\u003c/code\u003e.  HTML and JavaScript files provided in source\npackages or via the documentation upload facility were served\n\u003cem\u003eas-is\u003c/em\u003e on the main \u003ccode\u003ehackage.haskell.org\u003c/code\u003e domain.  As a consequence,\nwhen a user with latent HTTP credentials browses to the package\npages or documentation uploaded by a malicious package maintainer,\ntheir \u003cstrong\u003esession can be hijacked\u003c/strong\u003e to upload packages or\ndocumentation, amend maintainers or other package metadata, or\nperform any other action the user is authorised to do."
            }
          ],
          "value": "A critical XSS vulnerability affected hackage-server and\nhackage.haskell.org.  HTML and JavaScript files provided in source\npackages or via the documentation upload facility were served\nas-is on the main hackage.haskell.org domain.  As a consequence,\nwhen a user with latent HTTP credentials browses to the package\npages or documentation uploaded by a malicious package maintainer,\ntheir session can be hijacked to upload packages or\ndocumentation, amend maintainers or other package metadata, or\nperform any other action the user is authorised to do."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 9.9,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper neutralization of input during web page generation (\u0027cross-site scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-23T14:53:47.724Z",
        "orgId": "74b3a70d-cca6-4d34-9789-e83b222ae3be",
        "shortName": "redhat-cnalr"
      },
      "references": [
        {
          "url": "https://osv.dev/vulnerability/HSEC-2024-0004"
        }
      ],
      "title": "Hackage package and doc upload stored XSS vulnerability",
      "x_generator": {
        "engine": "Vulnogram 1.0.1"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "74b3a70d-cca6-4d34-9789-e83b222ae3be",
    "assignerShortName": "redhat-cnalr",
    "cveId": "CVE-2026-40470",
    "datePublished": "2026-04-23T14:53:47.724Z",
    "dateReserved": "2026-04-13T15:23:17.067Z",
    "dateUpdated": "2026-04-23T16:22:27.341Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-40470\",\"sourceIdentifier\":\"74b3a70d-cca6-4d34-9789-e83b222ae3be\",\"published\":\"2026-04-23T16:16:25.523\",\"lastModified\":\"2026-04-23T16:16:25.523\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"A critical XSS vulnerability affected hackage-server and\\nhackage.haskell.org.  HTML and JavaScript files provided in source\\npackages or via the documentation upload facility were served\\nas-is on the main hackage.haskell.org domain.  As a consequence,\\nwhen a user with latent HTTP credentials browses to the package\\npages or documentation uploaded by a malicious package maintainer,\\ntheir session can be hijacked to upload packages or\\ndocumentation, amend maintainers or other package metadata, or\\nperform any other action the user is authorised to do.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"74b3a70d-cca6-4d34-9789-e83b222ae3be\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L\",\"baseScore\":9.9,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"LOW\"},\"exploitabilityScore\":3.1,\"impactScore\":6.0}]},\"weaknesses\":[{\"source\":\"74b3a70d-cca6-4d34-9789-e83b222ae3be\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-79\"}]}],\"references\":[{\"url\":\"https://osv.dev/vulnerability/HSEC-2024-0004\",\"source\":\"74b3a70d-cca6-4d34-9789-e83b222ae3be\"}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-40470\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-04-23T16:19:40.142224Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-04-23T16:19:49.844Z\"}}], \"cna\": {\"title\": \"Hackage package and doc upload stored XSS vulnerability\", \"metrics\": [{\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"CHANGED\", \"version\": \"3.1\", \"baseScore\": 9.9, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"CRITICAL\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"LOW\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"HIGH\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"versions\": [{\"status\": \"affected\", \"version\": \"0.1\", \"lessThan\": \"0.6\", \"versionType\": \"semver\"}], \"packageName\": \"hackage-server\", \"collectionURL\": \"https://hackage.haskell.org/package/hackage-server\", \"defaultStatus\": \"unaffected\"}], \"datePublic\": \"2026-01-16T14:18:00.000Z\", \"references\": [{\"url\": \"https://osv.dev/vulnerability/HSEC-2024-0004\"}], \"x_generator\": {\"engine\": \"Vulnogram 1.0.1\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"A critical XSS vulnerability affected hackage-server and\\nhackage.haskell.org.  HTML and JavaScript files provided in source\\npackages or via the documentation upload facility were served\\nas-is on the main hackage.haskell.org domain.  As a consequence,\\nwhen a user with latent HTTP credentials browses to the package\\npages or documentation uploaded by a malicious package maintainer,\\ntheir session can be hijacked to upload packages or\\ndocumentation, amend maintainers or other package metadata, or\\nperform any other action the user is authorised to do.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"A \u003cstrong\u003ecritical XSS vulnerability\u003c/strong\u003e affected \u003cem\u003ehackage-server\u003c/em\u003e and\\n\u003ccode\u003ehackage.haskell.org\u003c/code\u003e.  HTML and JavaScript files provided in source\\npackages or via the documentation upload facility were served\\n\u003cem\u003eas-is\u003c/em\u003e on the main \u003ccode\u003ehackage.haskell.org\u003c/code\u003e domain.  As a consequence,\\nwhen a user with latent HTTP credentials browses to the package\\npages or documentation uploaded by a malicious package maintainer,\\ntheir \u003cstrong\u003esession can be hijacked\u003c/strong\u003e to upload packages or\\ndocumentation, amend maintainers or other package metadata, or\\nperform any other action the user is authorised to do.\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-79\", \"description\": \"CWE-79 Improper neutralization of input during web page generation (\u0027cross-site scripting\u0027)\"}]}], \"providerMetadata\": {\"orgId\": \"74b3a70d-cca6-4d34-9789-e83b222ae3be\", \"shortName\": \"redhat-cnalr\", \"dateUpdated\": \"2026-04-23T14:53:47.724Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-40470\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-04-23T16:22:27.341Z\", \"dateReserved\": \"2026-04-13T15:23:17.067Z\", \"assignerOrgId\": \"74b3a70d-cca6-4d34-9789-e83b222ae3be\", \"datePublished\": \"2026-04-23T14:53:47.724Z\", \"assignerShortName\": \"redhat-cnalr\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.