cabal-install versions prior to 3.4.0.0 that use multiple repositories for package resolution are vulnerable to a dependency confusion supply chain attack. This occurs because the resolver picks the highest available version across all repositories, allowing a malicious actor to publish a higher version of a private package name in a public repository. Default configurations using only the public hackage.haskell.org or exclusively private curated repositories are not affected. Version 3.4.0.0 and later introduce an override option to mark a repository as canonical, preventing this attack.