This vulnerability (CWE-79) in hackage-server 0.1 involves improper sanitization of user-controlled metadata from .cabal files when rendered into HTML href attributes. This flaw enables stored Cross-Site Scripting (XSS) attacks, allowing attackers to inject malicious scripts that execute in users' browsers. The CVSS 3.1 score of 9.9 reflects network attack vector, low attack complexity, required privileges, no user interaction, and complete compromise of confidentiality and integrity with some impact on availability. The vulnerability is publicly disclosed but lacks an official fix or patch at this time.

Successful exploitation can lead to execution of arbitrary scripts in the context of the affected web application, potentially compromising user sessions, stealing sensitive information, or performing unauthorized actions on behalf of users. The critical CVSS score indicates a severe risk to confidentiality and integrity, with some impact on availability. There are no known exploits in the wild currently.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to the affected hackage-server instance and avoid processing untrusted .cabal metadata. Implementing input sanitization or output encoding on href attributes may mitigate risk but should be done following vendor recommendations once available.