CVE-2025-54128: @haxtheweb/haxcms-nodejs Vulnerability Due to Disabled Content Security Policy
Summary
CVE-2025-54128: NodeJS version of HAX CMS Has Disabled Content Security Policy That Enables Cross-Site Scripting. Affects @haxtheweb/haxcms-nodejs versions < 11.0.8. Fixed in 11.0.8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @haxtheweb/haxcms-nodejs package is a NodeJS implementation of HAX CMS, a content management system designed for web applications. It allows users to create and manage web content easily. However, the package has a critical security flaw due to a disabled Content Security Policy (CSP), making it vulnerable to cross-site scripting (XSS) attacks.
Vulnerability Detail
The vulnerability arises from the explicit disabling of the Content Security Policy in the application's Helmet configuration. This misconfiguration allows attackers to exploit XSS vulnerabilities, potentially executing arbitrary scripts and exfiltrating sensitive data, such as session tokens. The lack of CSP means that the application does not have the necessary protections against malicious scripts, which can lead to severe security breaches.
How To Fix
Minimum fixed version
11.0.8
This is the first release that contains the fix.
npm install @haxtheweb/haxcms-nodejs@11.0.8Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can manually enable the Content Security Policy in your application by modifying the Helmet configuration in app.js. Add the following code snippet to your app.js file:
const helmet = require('helmet');
app.use(helmet({
contentSecurityPolicy: {
directives: {
defaultSrc: ['self'],
scriptSrc: ['self']
}
}
}));
This will help protect against XSS attacks until you can update the package.
Conclusion
The @haxtheweb/haxcms-nodejs package has a significant vulnerability due to a disabled Content Security Policy, which can lead to XSS attacks. It is crucial to update to the patched version or implement a workaround to protect your application from potential exploits.
See every vulnerability recorded for @haxtheweb/haxcms-nodejs →
FAQ
The impact includes the potential for attackers to execute arbitrary scripts, leading to data exfiltration and unauthorized access to sensitive information.
You can use Vulert, which monitors open-source vulnerabilities in real-time. Simply upload your package-lock.json file to check for vulnerabilities without needing to access the code.
Yes, the vulnerability is patched in version 11.0.8 of the @haxtheweb/haxcms-nodejs package. Updating to this version will resolve the issue.
CSP is a security feature that helps prevent XSS attacks by controlling which resources can be loaded and executed in a web application.
If immediate updates are not possible, implement the workaround by enabling CSP in your application to mitigate the risk until you can apply the patch.
References
Related vulnerabilities
Recent vulnerabilities recorded for @haxtheweb/haxcms-nodejs.
