A stored cross‑site scripting flaw exists in the Hackage package repository. HTML and JavaScript files that are provided either through source packages or uploaded documentation are served verbatim on the main hackage.haskell.org domain. When a user with authenticated HTTP credentials visits a page containing malicious content, the script executes in the user’s browser, enabling the attacker to hijack the session. This allows the attacker to perform any action that the compromised user is authorized to do, including uploading packages, modifying package metadata, or altering maintainer information. The flaw is a classic CWE‑79 vulnerability.

The affected products are the hackage-server and the public hackage.haskell.org site. No specific version information is provided in the advisory, so any instance that has not applied the patch is considered vulnerable.

The CVSS score of 9.9 indicates critical severity. The EPSS score of <1% shows a very low probability of exploitation at the time of the analysis, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a web attack where a malicious package maintainer or attacker who can upload documentation crafts malicious HTML/JavaScript. Once the page is accessed by an authenticated user, the exploit succeeds, allowing privilege escalation within that user’s session.