keter · Reflected XSS Vulnerability
Affects keterSource GCVE Database
Rated High by Threat Radar's AI analysis
- Patch
- Available – fixed in 1.8.4
Data as of 13 Nov 2026, 18:40 UTC
What to do
Upgrade keter to 1.8.4.
Patches and advisories
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| Hackageketer | Affected
| Fixed in
|
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
AI-suggested
Upgrade Keter to version 1.8.4 or later, where this vulnerability is fixed. The patch is available at the official GitHub repository. No other mitigation is specifically required as the vulnerability is addressed by the official fix.
Description
Keter, an app-server/reverse-proxy used with Yesod web-framework webapps, has a reflected cross-site scripting (XSS) vulnerability. The vulnerability arises because Keter echoes back the Host header value unescaped in an HTML error page during VHost dispatch handling. While direct exploitation from a browser is generally limited due to Host header restrictions, the flaw could be exploitable if combined with other upstream weaknesses in the HTTP proxy chain. A fix is available in version 1.8.4.