CVE-2026-40470

{"id": "CVE-2026-40470", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "74b3a70d-cca6-4d34-9789-e83b222ae3be", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.9, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 3.1}]}, "published": "2026-04-23T16:16:25.523", "references": [{"url": "https://osv.dev/vulnerability/HSEC-2024-0004", "source": "74b3a70d-cca6-4d34-9789-e83b222ae3be"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "74b3a70d-cca6-4d34-9789-e83b222ae3be", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "A critical XSS vulnerability affected hackage-server and\nhackage.haskell.org. HTML and JavaScript files provided in source\npackages or via the documentation upload facility were served\nas-is on the main hackage.haskell.org domain. As a consequence,\nwhen a user with latent HTTP credentials browses to the package\npages or documentation uploaded by a malicious package maintainer,\ntheir session can be hijacked to upload packages or\ndocumentation, amend maintainers or other package metadata, or\nperform any other action the user is authorised to do."}], "lastModified": "2026-04-24T14:41:55.890", "sourceIdentifier": "74b3a70d-cca6-4d34-9789-e83b222ae3be"}