Hackage-Server Stored Cross-Site Scripting Vulnerability

A stored cross-site scripting vulnerability has been identified in hackage-server. User-controlled metadata from .cabal files is rendered into HTML href attributes without adequate sanitization, allowing for the injection of malicious scripts. This issue affects several fields, including 'homepage', 'bug-reports', 'source-repository.location', and 'description' (Haddock hyperlinks). The vulnerability exists in all published versions of hackage-server.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected scripts are executed in the context of the user.

Remediation

The vulnerability has been fixed in hackage-server version 2de3ae45082f8f3f29a41f6aff620d09d0e74058. Users should update to this version or later.