Critical XSS in hackage-server via Malicious .cabal Metadata

The National Vulnerability Database has disclosed CVE-2026-40472, a critical stored Cross-Site Scripting (XSS) vulnerability impacting hackage-server. This flaw, rated 9.9 CVSS, allows attackers to inject malicious code into HTML href attributes by manipulating user-controlled metadata within .cabal files. The lack of proper sanitization means that when these .cabal files are processed and rendered, the embedded scripts execute in the context of other users’ browsers.

This isn’t just a theoretical bug; it’s a direct avenue for highly impactful attacks. A successful exploitation could lead to session hijacking, data theft, or defacement of the hackage-server interface for anyone viewing the malicious package. The attacker’s calculus here is simple: craft a poisoned .cabal file, publish it, and wait for unsuspecting developers or users to browse the package details. Given the nature of package repositories, this vector is particularly insidious because it leverages trust in the ecosystem itself.

For defenders, the message is clear: if your development pipeline or internal systems interact with or host hackage-server, prioritize patching. This is a supply chain risk through and through. Attackers frequently target development infrastructure to pivot into broader environments. Ensure all inputs, especially user-controlled metadata, are rigorously sanitized before rendering to prevent such injection flaws.