CVE-2026-40472

In hackage-server, user-controlled metadata from .cabal files are rendered into HTML
href attributes without proper sanitization, enabling stored
Cross-Site Scripting (XSS) attacks.

More information : https://osv.dev/vulnerability/HSEC-2026-0004