# XSS vulnerability in Hydra

**URL:** https://discourse.nixos.org/t/xss-vulnerability-in-hydra/43904
**Category:** Hydra
**Created:** [April 22, 2024, 3:05pm UTC](https://discourse.nixos.org/t/xss-vulnerability-in-hydra/43904 "2024-04-22T15:05:58Z")
**Posts on this page:** 1
**Page:** 1

<div class="post-metadata">

### Author: ![das\_j](https://discourse.nixos.org/user_avatar/discourse.nixos.org/das_j/32/5144_2.png) [@das\_j](https://discourse.nixos.org/u/das_j)
#### Post date: [April 22, 2024, 3:05pm UTC](https://discourse.nixos.org/t/xss-vulnerability-in-hydra/43904/1 "2024-04-22T15:05:58Z")

</div>

The Hydra package has a persistent XSS vulnerability when serving HTML files, registered as CVE-2024-32657.  
This has already been patched for [https://hydra.nixos.org](https://hydra.nixos.org) and corresponding PRs have been opened to nixpkgs.

Details about the vulnerability can be found on [GitHub](https://github.com/NixOS/hydra/security/advisories/GHSA-2p75-6g9f-pqgx)