Critical XSS in Hackage Server Exposes User Sessions

The National Vulnerability Database has disclosed CVE-2026-40470, a critical Cross-Site Scripting (XSS) vulnerability impacting hackage-server and hackage.haskell.org. This flaw allowed HTML and JavaScript files within source packages or documentation uploads to be served directly on the main domain. This isn’t just a minor display issue; it’s a fundamental breakdown of content isolation.

Attackers, specifically malicious package maintainers, could leverage this to deliver arbitrary HTML and JavaScript. When a user browsed these compromised package pages or documentation, their HTTP session credentials were at risk. This means an attacker could hijack sessions, enabling unauthorized package uploads, modification of maintainer details, alteration of package metadata, or any other action the compromised user was authorized to perform. The CVSS score of 9.9 (Critical) accurately reflects the severe impact: a complete takeover of a user’s account with minimal user interaction.

This isn’t theoretical; it’s a direct path to supply chain compromise. If the maintainer of a widely used Haskell library had their session hijacked, the implications could ripple across numerous projects. Defenders need to understand that trust in package repositories is paramount, and vulnerabilities like this erode that trust, creating a vector for widespread malicious code injection.