CRITICAL: CVE-2026-40470 (CVSS 9.9) — multiple products

CVE: CVE-2026-40470

CVSS: 9.9 (3.1) — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L

Severity: CRITICAL

Status: Critical advisory

Affected

_See vendor advisory_

Summary

A critical XSS vulnerability affected hackage-server and

hackage.haskell.org. HTML and JavaScript files provided in source

packages or via the documentation upload facility were served

as-is on the main hackage.haskell.org domain. As a consequence,

when a user with latent HTTP credentials browses to the package

pages or documentation uploaded by a malicious package maintainer,

their session can be hijacked to upload packages or

documentation, amend maintainers or other package metadata, or

perform any other action the user is authorised to do.

Verified Sources

References

https://osv.dev/vulnerability/HSEC-2024-0004

_Validated by the Lyrie Threat Intelligence Pipeline — 3 independent sources confirmed before publication. No speculation._

Lyrie Verdict

A vulnerability of this severity is exactly what Lyrie's anti-rogue-AI defense is built for: continuous, autonomous monitoring that doesn't wait for human reaction time.

#critical