CVE-2026-40472

Published: Apr 23, 2026Modified: Jun 17, 2026

9.9

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L

Exploitability: 3.1 / Impact: 6.0

Source: 74b3a70d-cca6-4d34-9789-e83b222ae3be (Secondary)

Description

In hackage-server, user-controlled metadata from .cabal files are rendered into HTML href attributes without proper sanitization, enabling stored Cross-Site Scripting (XSS) attacks.

Related CWEs

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (1)

https://osv.dev/vulnerability/HSEC-2026-0004

Source: 74b3a70d-cca6-4d34-9789-e83b222ae3be

Timeline

No history available yet.