CVE-2026-40472 (GCVE-0-2026-40472)

Vulnerability from cvelistv5 – Published: 2026-04-23 15:00 – Updated: 2026-04-23 16:22

Title

Hackage package metadata stored XSS vulnerability

Summary

In hackage-server, user-controlled metadata from .cabal files are rendered into HTML href attributes without proper sanitization, enabling stored Cross-Site Scripting (XSS) attacks.

Severity ?

9.9 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L

CWE

CWE-79 - Improper neutralization of input during web page generation ('cross-site scripting')

Assigner

redhat-cnalr

References

URL

Tags

https://osv.dev/vulnerability/HSEC-2026-0004

Impacted products

	Vendor	Product	Version
			Affected: 0.1 , < * (semver)

Date Public ?

2026-03-28 19:05

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-40472",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-04-23T16:15:39.611590Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-04-23T16:22:06.841Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://hackage.haskell.org/package/hackage-server",
          "defaultStatus": "unaffected",
          "packageName": "hackage-server",
          "versions": [
            {
              "lessThan": "*",
              "status": "affected",
              "version": "0.1",
              "versionType": "semver"
            }
          ]
        }
      ],
      "datePublic": "2026-03-28T19:05:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "In hackage-server, user-controlled metadata from \u003ccode\u003e.cabal\u003c/code\u003e files are rendered into HTML\n\u003ccode\u003ehref\u003c/code\u003e attributes without proper sanitization, enabling stored\nCross-Site Scripting (XSS) attacks."
            }
          ],
          "value": "In hackage-server, user-controlled metadata from .cabal files are rendered into HTML\nhref attributes without proper sanitization, enabling stored\nCross-Site Scripting (XSS) attacks."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 9.9,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper neutralization of input during web page generation (\u0027cross-site scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-23T15:00:09.063Z",
        "orgId": "74b3a70d-cca6-4d34-9789-e83b222ae3be",
        "shortName": "redhat-cnalr"
      },
      "references": [
        {
          "url": "https://osv.dev/vulnerability/HSEC-2026-0004"
        }
      ],
      "title": "Hackage package metadata stored XSS vulnerability",
      "x_generator": {
        "engine": "Vulnogram 1.0.1"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "74b3a70d-cca6-4d34-9789-e83b222ae3be",
    "assignerShortName": "redhat-cnalr",
    "cveId": "CVE-2026-40472",
    "datePublished": "2026-04-23T15:00:09.063Z",
    "dateReserved": "2026-04-13T15:23:17.068Z",
    "dateUpdated": "2026-04-23T16:22:06.841Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-40472\",\"sourceIdentifier\":\"74b3a70d-cca6-4d34-9789-e83b222ae3be\",\"published\":\"2026-04-23T16:16:25.753\",\"lastModified\":\"2026-04-23T16:16:25.753\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In hackage-server, user-controlled metadata from .cabal files are rendered into HTML\\nhref attributes without proper sanitization, enabling stored\\nCross-Site Scripting (XSS) attacks.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"74b3a70d-cca6-4d34-9789-e83b222ae3be\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L\",\"baseScore\":9.9,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"LOW\"},\"exploitabilityScore\":3.1,\"impactScore\":6.0}]},\"weaknesses\":[{\"source\":\"74b3a70d-cca6-4d34-9789-e83b222ae3be\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-79\"}]}],\"references\":[{\"url\":\"https://osv.dev/vulnerability/HSEC-2026-0004\",\"source\":\"74b3a70d-cca6-4d34-9789-e83b222ae3be\"}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-40472\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-04-23T16:15:39.611590Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-04-23T16:15:44.107Z\"}}], \"cna\": {\"title\": \"Hackage package metadata stored XSS vulnerability\", \"metrics\": [{\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"CHANGED\", \"version\": \"3.1\", \"baseScore\": 9.9, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"CRITICAL\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"LOW\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"HIGH\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"versions\": [{\"status\": \"affected\", \"version\": \"0.1\", \"lessThan\": \"*\", \"versionType\": \"semver\"}], \"packageName\": \"hackage-server\", \"collectionURL\": \"https://hackage.haskell.org/package/hackage-server\", \"defaultStatus\": \"unaffected\"}], \"datePublic\": \"2026-03-28T19:05:00.000Z\", \"references\": [{\"url\": \"https://osv.dev/vulnerability/HSEC-2026-0004\"}], \"x_generator\": {\"engine\": \"Vulnogram 1.0.1\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In hackage-server, user-controlled metadata from .cabal files are rendered into HTML\\nhref attributes without proper sanitization, enabling stored\\nCross-Site Scripting (XSS) attacks.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"In hackage-server, user-controlled metadata from \u003ccode\u003e.cabal\u003c/code\u003e files are rendered into HTML\\n\u003ccode\u003ehref\u003c/code\u003e attributes without proper sanitization, enabling stored\\nCross-Site Scripting (XSS) attacks.\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-79\", \"description\": \"CWE-79 Improper neutralization of input during web page generation (\u0027cross-site scripting\u0027)\"}]}], \"providerMetadata\": {\"orgId\": \"74b3a70d-cca6-4d34-9789-e83b222ae3be\", \"shortName\": \"redhat-cnalr\", \"dateUpdated\": \"2026-04-23T15:00:09.063Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-40472\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-04-23T16:22:06.841Z\", \"dateReserved\": \"2026-04-13T15:23:17.068Z\", \"assignerOrgId\": \"74b3a70d-cca6-4d34-9789-e83b222ae3be\", \"datePublished\": \"2026-04-23T15:00:09.063Z\", \"assignerShortName\": \"redhat-cnalr\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

GHSA-8FW8-47CX-J4Q4

Vulnerability from github – Published: 2026-04-23 18:33 – Updated: 2026-04-23 18:33

Details

In hackage-server, user-controlled metadata from .cabal files are rendered into HTML href attributes without proper sanitization, enabling stored Cross-Site Scripting (XSS) attacks.

Severity ?

9.9 (Critical)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-40472"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-79"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-04-23T16:16:25Z",
    "severity": "CRITICAL"
  },
  "details": "In hackage-server, user-controlled metadata from .cabal files are rendered into HTML\nhref attributes without proper sanitization, enabling stored\nCross-Site Scripting (XSS) attacks.",
  "id": "GHSA-8fw8-47cx-j4q4",
  "modified": "2026-04-23T18:33:03Z",
  "published": "2026-04-23T18:33:03Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40472"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/HSEC-2026-0004"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L",
      "type": "CVSS_V3"
    }
  ]
}

FKIE_CVE-2026-40472

Vulnerability from fkie_nvd - Published: 2026-04-23 16:16 - Updated: 2026-04-23 16:16

Severity ?

9.9 (Critical) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L

Summary

In hackage-server, user-controlled metadata from .cabal files are rendered into HTML href attributes without proper sanitization, enabling stored Cross-Site Scripting (XSS) attacks.

References

	URL	Tags
	74b3a70d-cca6-4d34-9789-e83b222ae3be	https://osv.dev/vulnerability/HSEC-2026-0004

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In hackage-server, user-controlled metadata from .cabal files are rendered into HTML\nhref attributes without proper sanitization, enabling stored\nCross-Site Scripting (XSS) attacks."
    }
  ],
  "id": "CVE-2026-40472",
  "lastModified": "2026-04-23T16:16:25.753",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "LOW",
          "baseScore": 9.9,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "CHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L",
          "version": "3.1"
        },
        "exploitabilityScore": 3.1,
        "impactScore": 6.0,
        "source": "74b3a70d-cca6-4d34-9789-e83b222ae3be",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-04-23T16:16:25.753",
  "references": [
    {
      "source": "74b3a70d-cca6-4d34-9789-e83b222ae3be",
      "url": "https://osv.dev/vulnerability/HSEC-2026-0004"
    }
  ],
  "sourceIdentifier": "74b3a70d-cca6-4d34-9789-e83b222ae3be",
  "vulnStatus": "Received",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ],
      "source": "74b3a70d-cca6-4d34-9789-e83b222ae3be",
      "type": "Secondary"
    }
  ]
}

hsec-2026-0004

Vulnerability from osv_haskell

Published

2026-03-28 16:05

Modified

2026-03-28 16:05

Summary

Hackage package metadata stored XSS vulnerability

Details

Hackage package metadata stored XSS vulnerability

User-controlled metadata from .cabal files are rendered into HTML href attributes without proper sanitization, enabling stored Cross-Site Scripting (XSS) attacks. The specific fields affected are:

homepage
bug-reports
source-repository.location
description (Haddock hyperlinks)

The Haskell Security Response Team audited the entire corpus of published packages on hackage.haskell.org—all published package versions but not candidates. No exploitation attempts were detected.

To fix the issue, hackage-server now inspects target URIs and only produces a hyperlink when the URI has an approved scheme: http, https, and (only for some fields) mailto.

The fix has been committed and deployed on hackage.haskell.org. Other operations of hackage-server instances should update as soon as possible to commit 2de3ae45082f8f3f29a41f6aff620d09d0e74058 or later.

Acknowledgements

Joshua Rogers (https://joshua.hu/) of AISLE (https://aisle.com/) reported the issue to the Haskell Security Response Team.
Fraser Tweedale implemented the fix.
Gershom Bazerman merged the fix and deployed it to hackage.haskell.org.

References

URL

Type

https://github.com/haskell/hackage-server/commit/…

FIX

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "human_link": "https://github.com/haskell/security-advisories/tree/main/advisories/published/2026/HSEC-2026-0004.md",
        "osv": "https://raw.githubusercontent.com/haskell/security-advisories/refs/heads/generated/osv-export/2026/HSEC-2026-0004.json"
      },
      "package": {
        "ecosystem": "Hackage",
        "name": "hackage-server"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "severity": [
        {
          "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L",
          "type": "CVSS_V3"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-40472"
  ],
  "database_specific": {
    "home": "https://github.com/haskell/security-advisories",
    "osvs": "https://raw.githubusercontent.com/haskell/security-advisories/refs/heads/generated/osv-export",
    "repository": "https://github.com/haskell/security-advisories"
  },
  "details": "# Hackage package metadata stored XSS vulnerability\n\nUser-controlled metadata from `.cabal` files are rendered into HTML\n`href` attributes without proper sanitization, enabling stored\nCross-Site Scripting (XSS) attacks.  The specific fields affected\nare:\n\n- `homepage`\n- `bug-reports`\n- `source-repository.location`\n- `description` (Haddock hyperlinks)\n\nThe Haskell Security Response Team audited the entire corpus of\n**published** packages on `hackage.haskell.org`\u2014all published\npackage versions but *not* candidates.  No exploitation attempts\nwere detected.\n\nTo fix the issue, *hackage-server* now inspects target URIs and only\nproduces a hyperlink when the URI has an approved scheme: `http`,\n`https`, and (only for some fields) `mailto`.\n\nThe fix has been [committed][commit] and deployed on\n`hackage.haskell.org`.  Other operations of *hackage-server*\ninstances should update as soon as possible to commit\n`2de3ae45082f8f3f29a41f6aff620d09d0e74058` or later.\n\n## Acknowledgements\n\n- **Joshua Rogers** (https://joshua.hu/) of AISLE\n  (https://aisle.com/) reported the issue to the Haskell Security\n  Response Team.\n- **Fraser Tweedale** implemented the fix.\n- **Gershom Bazerman** merged the fix and deployed it to\n  `hackage.haskell.org`.\n\n[commit]: https://github.com/haskell/hackage-server/commit/2de3ae45082f8f3f29a41f6aff620d09d0e74058\n",
  "id": "HSEC-2026-0004",
  "modified": "2026-03-28T16:05:12Z",
  "published": "2026-03-28T16:05:12Z",
  "references": [
    {
      "type": "FIX",
      "url": "https://github.com/haskell/hackage-server/commit/2de3ae45082f8f3f29a41f6aff620d09d0e74058"
    }
  ],
  "schema_version": "1.5.0",
  "summary": "Hackage package metadata stored XSS vulnerability"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2026-40472 (GCVE-0-2026-40472)

GHSA-8FW8-47CX-J4Q4

FKIE_CVE-2026-40472

hsec-2026-0004

Vulnerability from osv_haskell

Hackage package metadata stored XSS vulnerability

Acknowledgements

Tags

Sightings

Nomenclature