# HSEC-2025-0005: cabal-install dependency confusion

> Attackers can hijack private Haskell packages by publishing malicious versions to public repositories, leading to code execution during dependency resolution.

- **Severity:** Not scored
- **Exploited in the wild:** Not known
- **Login needed:** Not needed
- **Attackable:** Over the internet
- **Victim action needed:** Not needed
- **Fix available:** Yes
- **Published:** 14 Nov 2025

## What is HSEC-2025-0005?

HSEC-2025-0005 is a vulnerability in cabal-install, published on 14 Nov 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.

### Official description

# `cabal-install` dependency confusion

For **cabal-install < 3.4.0.0** and where multiple repositories are
configured, the resolver picks the highest available version across
all repositories.  Where a package is only defined in a private
repository, this behaviour leads to a [*dependency confusion*][blog]
supply chain vulnerability.  If the private package name becomes
known, a malicious actor can claim the name in the public repository
and publish a malicious version at a higher version number.

Default `cabal-install` configurations that only use the
`hackage.haskell.org` repository are not affected.  Configurations
that use curated private repositories **exclusively** are also not
affected.

[blog]: https://frasertweedale.github.io/blog-fp/posts/2021-02-12-haskell-dependency-confusion.html

## Mitigations

*cabal-install* version **3.4.0.0** and higher provide an `override`
option in the repository configuration.  It marks the associated
repository as canonical for all packages defined in that repository.
No other repositories will be considered.  For example:

```
-- For packages in repo.example.com,
-- only versions in repo.example.com are considered
active-repositories:
  , hackage.haskell.org
  , repo.example.com:override
```

Users and organisations using private repositories that contain
private packages in addition to public repositories **MUST** use the
`override` option to prevent dependency confusion attacks.

Alternatively, projects and organisations can run a private instance
of *hackage-server* and carefully curate and review its contents.
Using that instance exclusively defeats supply chain attacks
including *dependency confusion*.  For *cabal-install < 3.4* and
where using multiple repositories, this is the only effective
mitigation against dependency confusion attacks.

## Which versions are affected by HSEC-2025-0005?

1 open source package ship an affected version, including cabal-install.


| Package | Ecosystem | Affected | Fixed in |
| --- | --- | --- | --- |
| `cabal-install` | Hackage | From 1.0.0.0 | 3.4.0.0 |

## How do I fix HSEC-2025-0005?

Upgrade cabal-install to 3.4.0.0 or later.

## Is HSEC-2025-0005 being exploited?

There is no known exploitation of HSEC-2025-0005 in the wild and no public exploit code.

## Fix prompt for AI coding agents

```text
Check this codebase for HSEC-2025-0005 and fix it if it is affected.

What it is: HSEC-2025-0005 is a vulnerability in cabal-install, published on 14 Nov 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Exploitation: There is no known exploitation of HSEC-2025-0005 in the wild and no public exploit code.

Affected packages and fixed versions:
- cabal-install (Hackage): affected from 1.0.0.0; fixed in 3.4.0.0

Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.

Reference: https://insights.sbomify.com/HSEC-2025-0005/ (Markdown: https://insights.sbomify.com/HSEC-2025-0005/index.md)
```

## Sources

- OSV: https://osv.dev/vulnerability/HSEC-2025-0005

---
From sbomify Insights: https://insights.sbomify.com/HSEC-2025-0005/
Summaries are generated and may contain mistakes; the official description above is the record.