What is the CVSS score of CVE-2026-40472?

CVE-2026-40472 has a CVSS 3.1 base score of 9.9 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L. EPSS exploitation probability: 0.0%.

Which versions of hackage-server are affected by CVE-2026-40472?

Hackage-server (the central Haskell package registry) contains a stored cross-site scripting vulnerability in package metadata handling that allows authenticated package uploaders to inject malicious…

How to fix or mitigate CVE-2026-40472?

Within 24 hours: Immediately audit recent package uploads for suspicious .cabal metadata patterns and restrict package upload privileges to a minimal set of trusted maintainers. Within 7 days: Deploy server-side output encoding for all HTML attribute contexts in package rendering, implement strict Content Security Policy (CSP) headers prohibiting inline scripts, and validate/sanitize all package metadata fields on ingestion. Within 30 days: Conduct full code review of metadata handling across all package repository surfaces, implement automated detection for XSS payloads in package files, and establish a security advisory process for affected users.

hackage-server CVE-2026-40472

EUVD-2026-25235 CRITICAL

Cross-site Scripting (XSS) (CWE-79)

2026-04-23 redhat-cnalr

GHSA-8fw8-47cx-j4q4

XSS

9.9

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.9 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L

vuln.today AI

5.4 MEDIUM

Authenticated uploader (PR:L) plants stored XSS but a victim must view/click the href link (UI:R); browser-context execution crosses scope (S:C) with limited C/I and no availability impact.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 04:43 vuln.today

EUVD ID Assigned

Apr 23, 2026 - 16:00 euvd

EUVD-2026-25235

CVE Published

Apr 23, 2026 - 15:00 nvd

CRITICAL 9.9

DescriptionCVE.org

In hackage-server, user-controlled metadata from .cabal files are rendered into HTML href attributes without proper sanitization, enabling stored Cross-Site Scripting (XSS) attacks.

AnalysisAI

Stored cross-site scripting in hackage-server (the Haskell Hackage package registry software) lets a low-privileged authenticated package uploader inject persistent JavaScript by placing crafted metadata in a package's .cabal file, which the server renders into HTML href attributes without sanitization (CWE-79). Because the payload persists in package pages, any user or maintainer viewing the affected package - potentially including administrators - can have script executed in their session. No public exploit has been identified at time of analysis and EPSS is very low (0.05%, 14th percentile), but SSVC rates the technical impact as total.

Technical ContextAI

hackage-server is the open-source software that powers Hackage, the central package archive for the Haskell ecosystem. Package authors submit a .cabal metadata file describing homepage, bug-tracker, source-repository and similar URL fields; hackage-server emits several of these values into anchor (href) attributes on rendered package pages. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation): the attacker-controlled .cabal strings are placed into an href context without HTML/URL-attribute encoding or scheme allow-listing, so a javascript: URI or attribute-breaking payload survives into the DOM. No CPE strings were supplied in the intelligence, so exact affected version boundaries are not machine-enumerated here.

Affected ProductsAI

The affected product is hackage-server, the software behind the Haskell Hackage package registry. No CPE strings, exact version numbers, or version ranges were provided in the supplied intelligence, so the affected-version boundaries are not confirmed here; consult the Haskell Security Advisory HSEC-2026-0004 at https://osv.dev/vulnerability/HSEC-2026-0004 and the NVD record at https://nvd.nist.gov/vuln/detail/CVE-2026-40472 (also tracked as EUVD-2026-25235 and VulDB 359158 at https://vuldb.com/vuln/359158) for the precise fixed and vulnerable revisions.

RemediationAI

Upgrade hackage-server to the fixed revision identified in Haskell Security Advisory HSEC-2026-0004 (https://osv.dev/vulnerability/HSEC-2026-0004); no exact fix version was included in the supplied data, so the released patched version is not independently confirmed here - verify against that advisory and the project's Git history before deploying. If an immediate upgrade is not possible, compensating controls include stripping or allow-listing URL schemes on rendered .cabal fields (permit only http/https/mailto and reject javascript:/data:), applying output encoding to href attributes at the template layer, and deploying a restrictive Content-Security-Policy (e.g. script-src 'self' with no inline execution) which blocks injected inline scripts at the cost of breaking any legitimate inline scripting on package pages. Operators can also gate or manually review new package uploads and metadata edits, which reduces exposure but slows publishing throughput.