← Database

CVE-2026-40472

CRITICAL CVSS: 9.9 Published: 2026-04-23 Modified: 2026-06-17

Description

In hackage-server, user-controlled metadata from .cabal files are rendered into HTML href attributes without proper sanitization, enabling stored Cross-Site Scripting (XSS) attacks.

Affected Platforms

Unknown

Weakness Type

CWE-79

References