CVE-2026-40470 json
Hackage package and doc upload stored XSS vulnerability
published 2026-01-16 9 mo ago modified 2026-06-17 4 mo ago also EUVD-2026-25233 , HSEC-2024-0004
- cvss
- 9.9
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.3%
- EPSS 0.3% chance of exploitation in 30 days, percentile 23%
- public exploits
- 0
- none known
Summary
A critical XSS vulnerability affected hackage-server and hackage.haskell.org. HTML and JavaScript files provided in source packages or via the documentation upload facility were served as-is on the main hackage.haskell.org domain. As a consequence, when a user with latent HTTP credentials browses to the package pages or documentation uploaded by a malicious package maintainer, their session can be hijacked to upload packages or documentation, amend maintainers or other package metadata, or perform any other action the user is authorised to do.
Patch / fix
- hackage hackage-server 0.6
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- total
- Assessed
- 6 mo ago
Exploit prediction
0.31% chance of exploitation in the next 30 days, higher than 23% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 9.9 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L |
| OSV | 3.1 | 9.9 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| hackage | hackage-server | >=0.1, <0.6 |
0.6 |
Classification
- Weakness
-
- CWE-79 Improper Neutralization of Input During Web Page Generation
References
-
github.com
/haskell/hackage-server/commit/5a0dc3357b042502fcf684ed7e2464fde1407809
patch
-
github.com
/haskell/hackage-server/commit/33d9ea3de9a298b21b53ba23386af2742384e627
patch
-
github.com
/haskell/hackage-server/commit/354a7de3b7f21ad1346677df515d8e8ec75016e6
patch
- osv.dev /vulnerability/HSEC-2024-0004
Sources
- CVE List CVE-2026-40470
- NVD CVE-2026-40470
- OSV HSEC-2024-0004
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.