cabal-install dependency confusion
Affects cabal-installSource GCVE Database
Rated High by Threat Radar's AI analysis
- Patch
- Available – fixed in 3.4.0.0
Data as of 13 Nov 2026, 18:41 UTC
What to do
Upgrade cabal-install to 3.4.0.0.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| Hackagecabal-install | Affected
| Fixed in
|
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
AI-suggested
Upgrade cabal-install to version 3.4.0.0 or later, which provides the override option to mark repositories as canonical and prevent dependency confusion. For versions prior to 3.4.0.0 using multiple repositories, the only effective mitigation is to use a private instance of hackage-server exclusively and carefully curate its contents. Users and organizations mixing private and public repositories must configure the override option to avoid this vulnerability.
Description
cabal-install versions prior to 3.4.0.0 that use multiple repositories for package resolution are vulnerable to a dependency confusion supply chain attack. This occurs because the resolver picks the highest available version across all repositories, allowing a malicious actor to publish a higher version of a private package name in a public repository. Default configurations using only the public hackage.haskell.org or exclusively private curated repositories are not affected. Version 3.4.0.0 and later introduce an override option to mark a repository as canonical, preventing this attack.