https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 15:54:26 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-292776 EUVD-2026-292776 https://cve.radiocsirt.org/vuln/euvd-2026-292776 https://cve.radiocsirt.org/vuln/fkie_cve-2026-40471 <p>hackage-server lacked Cross-Site Request Forgery (CSRF) protection across its endpoints. Scripts on foreign sites could trigger requests to hackage server, possibly abusing latent credentials to upload packages or perform other administrative actions. Some unauthenticated actions could also be abused (e.g. creating new user accounts).</p> <p>hackage-server lacked Cross-Site Request Forgery (CSRF) protection across its endpoints. Scripts on foreign sites could trigger requests to hackage server, possibly abusing latent credentials to upload packages or perform other administrative actions. Some unauthenticated actions could also be abused (e.g. creating new user accounts).</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-40471 https://cve.radiocsirt.org/vuln/ghsa-mf84-vmqg-86fm <p>hackage-server lacked Cross-Site Request Forgery (CSRF) protection across its endpoints. Scripts on foreign sites could trigger requests to hackage server, possibly abusing latent credentials to upload packages or perform other administrative actions. Some unauthenticated actions could also be abused (e.g. creating new user accounts).</p> <p>hackage-server lacked Cross-Site Request Forgery (CSRF) protection across its endpoints. Scripts on foreign sites could trigger requests to hackage server, possibly abusing latent credentials to upload packages or perform other administrative actions. Some unauthenticated actions could also be abused (e.g. creating new user accounts).</p> https://cve.radiocsirt.org/vuln/ghsa-mf84-vmqg-86fm https://cve.radiocsirt.org/vuln/hsec-2026-0002 <p><strong>Affected:</strong> Hackage: hackage-server</p> <p># Hackage CSRF vulnerability</p> <p>* Vulnerable File: `src/Distribution/Server/Features/Votes.hs` (example) * Impact: can forge requests through XSS</p> <p>hackage-server lacked Cross-Site Request Forgery (CSRF) protection across its endpoints. Scripts on foreign sites could trigger requests to hackage server, possibly abusing latent credentials to upload packages or perform other administrative actions. Some unauthenticated actions could also be abused (e.g. creating new user accounts).</p> <p>To fix the issue, a new CSRF middleware checks all requests. Requests using HTTP methods other than `GET`, `HEAD` and `OPTIONS` are subject to a check of the [`Sec-Fetch-Site` header][sec-fetch-site], which is [widely supported by modern browsers][caniuse-sec-fetch-site]. Cross-site requests are `403 Forbidden`. Certain approved and expected non-browser user agents (e.g. `cabal-install/*`) are exempted from the check, as are requests using token authentication (`Authorization: X-ApiKey ...`).</p> <p>The fix has been [committed][commit] and deployed on `hackage.haskell.org`.</p> <p>## Acknowledgements</p> <p>- **Joshua Rogers** (https://joshua.hu/) of AISLE (https://aisle.com/) reported the issue to the Haskell Security Response Team. - **Spenser Janssen** implemented the fix, and **Fraser Tweedale** reviewed it. - **Gershom Bazerman** merged the fix and deployed it to `hackage.haskell.org`.</p> <p>[sec-fetch-site]: https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Sec-Fetch-Site [caniuse-sec-fet…</p> <p><strong>Affected:</strong> Hackage: hackage-server</p> <p># Hackage CSRF vulnerability</p> <p>* Vulnerable File: `src/Distribution/Server/Features/Votes.hs` (example) * Impact: can forge requests through XSS</p> <p>hackage-server lacked Cross-Site Request Forgery (CSRF) protection across its endpoints. Scripts on foreign sites could trigger requests to hackage server, possibly abusing latent credentials to upload packages or perform other administrative actions. Some unauthenticated actions could also be abused (e.g. creating new user accounts).</p> <p>To fix the issue, a new CSRF middleware checks all requests. Requests using HTTP methods other than `GET`, `HEAD` and `OPTIONS` are subject to a check of the [`Sec-Fetch-Site` header][sec-fetch-site], which is [widely supported by modern browsers][caniuse-sec-fetch-site]. Cross-site requests are `403 Forbidden`. Certain approved and expected non-browser user agents (e.g. `cabal-install/*`) are exempted from the check, as are requests using token authentication (`Authorization: X-ApiKey ...`).</p> <p>The fix has been [committed][commit] and deployed on `hackage.haskell.org`.</p> <p>## Acknowledgements</p> <p>- **Joshua Rogers** (https://joshua.hu/) of AISLE (https://aisle.com/) reported the issue to the Haskell Security Response Team. - **Spenser Janssen** implemented the fix, and **Fraser Tweedale** reviewed it. - **Gershom Bazerman** merged the fix and deployed it to `hackage.haskell.org`.</p> <p>[sec-fetch-site]: https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Sec-Fetch-Site [caniuse-sec-fet…</p> https://cve.radiocsirt.org/vuln/hsec-2026-0002