Stored XSS in hackage-server via unsanitized .cabal metadata (CVE-2026-40472)

User-controlled metadata from .cabal files is rendered into HTML href attributes without proper sanitization in hackage-server, enabling stored Cross-Site Scripting (XSS) attacks. The affected fields include homepage, bug-reports, source-repository.location, and Haddock hyperlinks in the description field. An authenticated user with package publishing access could inject malicious scripts affecting other users of any hackage-server instance. Affected versions: - 0.* - 0.4 - 0.5.0 We recommend updating to: commit 2de3ae45082f8f3f29a41f6aff620d09d0e74058 or later. CVSS 9.9 · our assessment: act_now Reference: https://osv.dev/vulnerability/HSEC-2026-0004 Details: https://vuln.today/cve/CVE-2026-40472