What is the CVSS score of CVE-2026-40470?

CVE-2026-40470 has a CVSS 3.1 base score of 9.9 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L. EPSS exploitation probability: 0.0%.

Which versions of hackage-server are affected by CVE-2026-40470?

CVE-2026-40470 affects hackage-server, the central package repository for the Haskell ecosystem, enabling authenticated package maintainers to inject malicious code that compromises any other…

How to fix or mitigate CVE-2026-40470?

Within 24 hours, determine whether your organization publishes Haskell packages to hackage.haskell.org or relies on packages from hackage.haskell.org in production; if either is true, audit all uploaded packages and documentation for embedded HTML or JavaScript anomalies, and review authentication logs for unauthorized package or metadata changes. Within 7 days, implement strict Content Security Policy headers (frame-ancestors, script-src) on internal mirrors if used, require multi-factor authentication for all package maintainers with upload privileges, and instruct developers to verify package checksums against upstream sources before dependencies are resolved. Within 30 days, monitor the Haskell Security Advisory channels and hackage.haskell.org status page for vendor patches; prepare application patches pinning specific safe versions of critical dependencies; and consider implementing package pinning and integrity verification in your build pipeline as a long-term defense-in-depth control.

hackage-server CVE-2026-40470

EUVD-2026-25233 CRITICAL

Cross-site Scripting (XSS) (CWE-79)

2026-04-23 redhat-cnalr

GHSA-hxp4-rf8g-9mwq

XSS

9.9

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.9 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L

vuln.today AI

8.7 HIGH

Requires a low-privileged maintainer account (PR:L) and a victim browsing the malicious page (UI:R); same-origin stored XSS crosses trust boundary (S:C) enabling session theft and package tampering (C:H/I:H), with no real availability loss (A:N).

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 04:46 vuln.today

EUVD ID Assigned

Apr 23, 2026 - 16:00 euvd

EUVD-2026-25233

CVE Published

Apr 23, 2026 - 14:53 nvd

CRITICAL 9.9

DescriptionCVE.org

A critical XSS vulnerability affected hackage-server and hackage.haskell.org. HTML and JavaScript files provided in source packages or via the documentation upload facility were served as-is on the main hackage.haskell.org domain. As a consequence, when a user with latent HTTP credentials browses to the package pages or documentation uploaded by a malicious package maintainer, their session can be hijacked to upload packages or documentation, amend maintainers or other package metadata, or perform any other action the user is authorised to do.

AnalysisAI

Stored cross-site scripting in hackage-server (the software powering hackage.haskell.org) allowed HTML and JavaScript embedded in source packages or documentation uploads to be served unsanitized from the primary hackage.haskell.org origin. A low-privileged, authenticated package maintainer could plant a malicious payload so that any authenticated user visiting the affected package or documentation pages would have their active session hijacked, letting the attacker upload packages/docs, alter maintainer lists and metadata, or perform any action the victim is authorized to do. There is no public exploit identified at time of analysis, and EPSS is very low (0.05%), but the CVSS 9.9 rating reflects the total technical impact of a same-origin XSS on a central package-signing authority.

Technical ContextAI

The affected component is hackage-server, the Haskell open-source software behind the central package archive hackage.haskell.org. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation): attacker-supplied HTML/JS contained in uploaded source tarballs or documentation bundles was returned with an active content type on the main application domain rather than being sanitized, sandboxed, or served from an isolated origin. Because the scripts execute in the security context of hackage.haskell.org itself, they gain access to the victim's authenticated session for that origin - the classic danger of serving user-controlled documentation/artifacts from the same origin that also handles privileged upload and metadata-management actions.

Affected ProductsAI

The vulnerability affects hackage-server, the Haskell package-repository server software, and the production deployment at hackage.haskell.org (the central Haskell package archive). No specific version range or CPE string was provided in the source data; affected versions should be confirmed via the Haskell Security Advisories entry referenced at https://osv.dev/vulnerability/HSEC-2024-0004 and the aggregated advisories at https://nvd.nist.gov/vuln/detail/CVE-2026-40470 and https://vuldb.com/vuln/359152. Private or mirrored hackage-server instances built from affected code would share the same exposure.

RemediationAI

No vendor-released patch version is identified in the provided data; consult the Haskell Security Advisory HSEC-2024-0004 (https://osv.dev/vulnerability/HSEC-2024-0004) for the fixed hackage-server release and apply it - the central hackage.haskell.org instance is operator-controlled and would have been remediated server-side. The core fix is to stop serving user-uploaded HTML/JS from the primary origin: serve documentation and package-provided HTML from a separate sandbox domain, and/or force a non-rendering content type (e.g., text/plain or Content-Disposition: attachment) plus a restrictive Content-Security-Policy that disallows inline script on the main domain. As interim compensating controls for private instances, disable or restrict the documentation-upload facility (trade-off: maintainers lose hosted Haddock docs) and block browser rendering of package-supplied .html/.js by overriding the served content type (trade-off: legitimate in-tarball HTML no longer renders inline). Advisory/reference URLs: https://osv.dev/vulnerability/HSEC-2024-0004, https://nvd.nist.gov/vuln/detail/CVE-2026-40470, https://vuldb.com/vuln/359152.