{"answers":{"affected":"1 open source package ship an affected version, including cabal-install.","exploited":"There is no known exploitation of HSEC-2025-0005 in the wild and no public exploit code.","fix":"Upgrade cabal-install to 3.4.0.0 or later.","what":"HSEC-2025-0005 is a vulnerability in cabal-install, published on 14 Nov 2025. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for HSEC-2025-0005 and fix it if it is affected.\n\nWhat it is: HSEC-2025-0005 is a vulnerability in cabal-install, published on 14 Nov 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: There is no known exploitation of HSEC-2025-0005 in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- cabal-install (Hackage): affected from 1.0.0.0; fixed in 3.4.0.0\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/HSEC-2025-0005/ (Markdown: https://insights.sbomify.com/HSEC-2025-0005/index.md)","id":"HSEC-2025-0005","markdown":"https://insights.sbomify.com/HSEC-2025-0005/index.md","name":"HSEC-2025-0005","record":{"aliases":[],"analysis":{"component_type":"developer_tool","fix_type":"upgrade","impacts":["code_execution"],"network_reachable":"yes","non_default_config":true,"product_category":"Haskell package manager","requires_auth":"none","summary":"Attackers can hijack private Haskell packages by publishing malicious versions to public repositories, leading to code execution during dependency resolution.","user_interaction":"not_required","vuln_class":"supply_chain"},"analysis_generated_by":"qwen3.8-flash-next","assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"# `cabal-install` dependency confusion\n\nFor **cabal-install \u003c 3.4.0.0** and where multiple repositories are\nconfigured, the resolver picks the highest available version across\nall repositories.  Where a package is only defined in a private\nrepository, this behaviour leads to a [*dependency confusion*][blog]\nsupply chain vulnerability.  If the private package name becomes\nknown, a malicious actor can claim the name in the public repository\nand publish a malicious version at a higher version number.\n\nDefault `cabal-install` configurations that only use the\n`hackage.haskell.org` repository are not affected.  Configurations\nthat use curated private repositories **exclusively** are also not\naffected.\n\n[blog]: https://frasertweedale.github.io/blog-fp/posts/2021-02-12-haskell-dependency-confusion.html\n\n## Mitigations\n\n*cabal-install* version **3.4.0.0** and higher provide an `override`\noption in the repository configuration.  It marks the associated\nrepository as canonical for all packages defined in that repository.\nNo other repositories will be considered.  For example:\n\n```\n-- For packages in repo.example.com,\n-- only versions in repo.example.com are considered\nactive-repositories:\n  , hackage.haskell.org\n  , repo.example.com:override\n```\n\nUsers and organisations using private repositories that contain\nprivate packages in addition to public repositories **MUST** use the\n`override` option to prevent dependency confusion attacks.\n\nAlternatively, projects and organisations can run a private instance\nof *hackage-server* and carefully curate and review its contents.\nUsing that instance exclusively defeats supply chain attacks\nincluding *dependency confusion*.  For *cabal-install \u003c 3.4* and\nwhere using multiple repositories, this is the only effective\nmitigation against dependency confusion attacks.","ecosystems":["Hackage"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":true,"headline":"cabal-install dependency confusion","id":"HSEC-2025-0005","indexable":true,"kev":null,"kind":"advisory","links":{"ecosystem":null,"product":null,"products":[],"type":"supply_chain","year":"2025"},"n_packages":1,"n_references":null,"packages":[{"ecosystem":"Hackage","fixed":["3.4.0.0"],"introduced":["1.0.0.0"],"last_affected":[],"package":"cabal-install","purl":"pkg:hackage/cabal-install","source":"HSEC-2025-0005"}],"products":null,"published":"2025-11-14","related":[],"sources":[{"class":"open","licence":"CC0 1.0","name":"Haskell Security Response Team","prefix":"HSEC"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":"Attackers can hijack private Haskell packages by publishing malicious versions to public repositories, leading to code execution during dependency resolution.","url":"https://insights.sbomify.com/HSEC-2025-0005/"}