https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 22:06:39 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-292777 EUVD-2026-292777 https://cve.radiocsirt.org/vuln/euvd-2026-292777 https://cve.radiocsirt.org/vuln/fkie_cve-2026-40470 <p>A critical XSS vulnerability affected hackage-server and hackage.haskell.org. HTML and JavaScript files provided in source packages or via the documentation upload facility were served as-is on the main hackage.haskell.org domain. As a consequence, when a user with latent HTTP credentials browses to the package pages or documentation uploaded by a malicious package maintainer, their session can be hijacked to upload packages or documentation, amend maintainers or other package metadata, or perform any other action the user is authorised to do.</p> <p>A critical XSS vulnerability affected hackage-server and hackage.haskell.org. HTML and JavaScript files provided in source packages or via the documentation upload facility were served as-is on the main hackage.haskell.org domain. As a consequence, when a user with latent HTTP credentials browses to the package pages or documentation uploaded by a malicious package maintainer, their session can be hijacked to upload packages or documentation, amend maintainers or other package metadata, or perform any other action the user is authorised to do.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-40470 https://cve.radiocsirt.org/vuln/ghsa-hxp4-rf8g-9mwq <p>A critical XSS vulnerability affected hackage-server and hackage.haskell.org. HTML and JavaScript files provided in source packages or via the documentation upload facility were served as-is on the main hackage.haskell.org domain. As a consequence, when a user with latent HTTP credentials browses to the package pages or documentation uploaded by a malicious package maintainer, their session can be hijacked to upload packages or documentation, amend maintainers or other package metadata, or perform any other action the user is authorised to do.</p> <p>A critical XSS vulnerability affected hackage-server and hackage.haskell.org. HTML and JavaScript files provided in source packages or via the documentation upload facility were served as-is on the main hackage.haskell.org domain. As a consequence, when a user with latent HTTP credentials browses to the package pages or documentation uploaded by a malicious package maintainer, their session can be hijacked to upload packages or documentation, amend maintainers or other package metadata, or perform any other action the user is authorised to do.</p> https://cve.radiocsirt.org/vuln/ghsa-hxp4-rf8g-9mwq https://cve.radiocsirt.org/vuln/hsec-2024-0004 <p><strong>Affected:</strong> Hackage: hackage-server</p> <p># Hackage package and doc upload stored XSS vulnerability</p> <p>*Author: Fraser Tweedale (Haskell SRT)*</p> <p>## Executive summary</p> <p>A **critical XSS vulnerability** affected *hackage-server* and `hackage.haskell.org`. HTML and JavaScript files provided in source packages or via the documentation upload facility were served *as-is* on the main `hackage.haskell.org` domain. As a consequence, when a user with latent HTTP credentials browses to the package pages or documentation uploaded by a malicious package maintainer, their **session can be hijacked** to upload packages or documentation, amend maintainers or other package metadata, or perform any other action the user is authorised to do.</p> <p>This issue was discovered and reported to the Haskell Security Response Team (SRT) in June 2024. Remediations were progressively developed and deployed throughout 2025. **The known issues have been fully mitigated on `hackage.haskell.org` as of January 2026.**</p> <p>The mitigations involve serving user content from a sister domain. In the case of `hackage.haskell.org`, this domain is `hackage-content.haskell.org`.</p> <p>Operators of other *hackage-server* instances should update to the `master` branch from the upstream repository (https://github.com/haskell/hackage-server; commit `9a1887607d9b8d1a3b8b02c990ee144c0d402b79` or later), and configure the user content domain (new flag `--user-content-uri`).</p> <p>## Scope of the issue</p> <p>### Package documentation uploads</p> <p>Any Hackage user can upload documentation bun…</p> <p><strong>Affected:</strong> Hackage: hackage-server</p> <p># Hackage package and doc upload stored XSS vulnerability</p> <p>*Author: Fraser Tweedale (Haskell SRT)*</p> <p>## Executive summary</p> <p>A **critical XSS vulnerability** affected *hackage-server* and `hackage.haskell.org`. HTML and JavaScript files provided in source packages or via the documentation upload facility were served *as-is* on the main `hackage.haskell.org` domain. As a consequence, when a user with latent HTTP credentials browses to the package pages or documentation uploaded by a malicious package maintainer, their **session can be hijacked** to upload packages or documentation, amend maintainers or other package metadata, or perform any other action the user is authorised to do.</p> <p>This issue was discovered and reported to the Haskell Security Response Team (SRT) in June 2024. Remediations were progressively developed and deployed throughout 2025. **The known issues have been fully mitigated on `hackage.haskell.org` as of January 2026.**</p> <p>The mitigations involve serving user content from a sister domain. In the case of `hackage.haskell.org`, this domain is `hackage-content.haskell.org`.</p> <p>Operators of other *hackage-server* instances should update to the `master` branch from the upstream repository (https://github.com/haskell/hackage-server; commit `9a1887607d9b8d1a3b8b02c990ee144c0d402b79` or later), and configure the user content domain (new flag `--user-content-uri`).</p> <p>## Scope of the issue</p> <p>### Package documentation uploads</p> <p>Any Hackage user can upload documentation bun…</p> https://cve.radiocsirt.org/vuln/hsec-2024-0004