PT-2026-32986 · Hackage · Hackage-Server

Published 2026-01-16 · Updated 2026-04-23 · CVE-2026-40470

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L

Name of the Vulnerable Software and Affected Versions hackage-server (affected versions not specified)

Description Stored Cross-Site Scripting (XSS) occurs because HTML and JavaScript files provided in source packages or via the documentation upload facility are served as-is on the main domain. This allows a malicious package maintainer to execute scripts in the browser of users with latent HTTP credentials. Such scripts can hijack sessions to upload packages or documentation, amend maintainers, or modify package metadata without user interaction. Additionally, attackers could present counterfeit login forms to steal credentials. The issue specifically affects documentation bundles, including the quick-jump.min.js file and corresponding CSS, as well as HTML content within source tarballs.

Recommendations Update to the master branch from the upstream repository (commit 9a1887607d9b8d1a3b8b02c990ee144c0d402b79 or later) and configure the user content domain using the --user-content-uri flag.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-40470

HSEC-2024-0004

Affected Products

Hackage-Server

References · 7

• https://osv.dev/vulnerability/HSEC-2024-0004 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-40470 · Security Note
• https://github.com/haskell/hackage-server/commit/5a0dc3357b042502fcf684ed7e2464fde1407809 · Note
• https://github.com/haskell/hackage-server/commit/354a7de3b7f21ad1346677df515d8e8ec75016e6 · Note
• https://github.com/haskell/hackage-server/commit/33d9ea3de9a298b21b53ba23386af2742384e627 · Note
• https://github.com/haskell/security-advisories · Note
• https://raw.githubusercontent.com/haskell/security-advisories/refs/heads/generated/osv-export · Note