Destructive Header File Deletion in Cabal During Configure Process
Summary
HSEC-2026-0006: Cabal deletes project source files during configure. Affects Cabal versions >= 2.2. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Cabal is a system for building and packaging Haskell libraries and programs. It simplifies the process of managing Haskell projects by handling dependencies, building, and installation. However, a recent vulnerability has been identified that affects how Cabal manages header files during the configuration phase, potentially leading to unintended data loss.
Vulnerability Detail
The vulnerability arises from the checkDuplicateHeaders function in Distribution.Simple.Configure, which deletes header files from the source directory if a header with the same name exists in both the build and source directories. This behavior, introduced in commit 3a9830b, was intended to resolve header precedence issues but results in destructive file deletion during the build process. On Microsoft Windows, this can lead to the deletion of source files outside the project, posing a significant risk to developers.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, avoid using the configure command in Cabal until a patched version is available. Alternatively, manually ensure that header files do not have duplicates in both the source and build directories to prevent accidental deletion.
Conclusion
The vulnerability in Cabal regarding the deletion of header files during the configure process poses a significant risk to developers. It is crucial to update to a patched version of Cabal and to implement workarounds until a fix is available. Monitoring tools like Vulert can assist in identifying if your project is affected.
See every vulnerability recorded for Cabal →
FAQ
The vulnerability can lead to the accidental deletion of important header files from the source directory during the build process, which may disrupt development and cause data loss.
You can use Vulert, which monitors open-source vulnerabilities in your software. By utilizing the Vulert playground, you can check if your application is affected by this vulnerability without needing to sign up.
If an immediate update is not possible, refrain from using the configure command and ensure that header files do not conflict between the source and build directories.
While the deletion behavior can occur on any operating system, it poses a higher risk on Microsoft Windows due to the way file handling is managed.
Detailed information can be found in the security advisory published on GitHub, which outlines the vulnerability and its implications.
References
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
