This vulnerability involves improper neutralization of input during web page generation (CWE-79) in hackage-server and hackage.haskell.org version 0.1. Malicious HTML or JavaScript files provided via source packages or documentation uploads are served as-is on the main domain, enabling cross-site scripting attacks. Users with latent HTTP credentials visiting these pages can have their sessions hijacked, allowing attackers to perform any actions authorized to the victim user, including uploading or modifying packages and metadata. The CVSS 3.1 base score is 9.9, reflecting critical impact with network attack vector, low attack complexity, required privileges, no user interaction, and high confidentiality, integrity, and low availability impacts. No patch or official remediation is currently documented.

Successful exploitation allows attackers to hijack sessions of users with latent HTTP credentials on hackage.haskell.org, enabling unauthorized package uploads, documentation uploads, and modification of maintainers or package metadata. This compromises the integrity and confidentiality of the package repository and can lead to further malicious activity under the guise of legitimate users.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users and administrators should exercise caution when interacting with untrusted packages or documentation on hackage.haskell.org. Consider restricting access or monitoring for suspicious activity related to package uploads and metadata changes.