CVE-2026-46396: Stored XSS in HAX CMS via <iframe> Allows Account Takeover
Summary
CVE-2026-46396: Stored XSS via in HAX CMS allows access to sensitive client-side data and account takeover. Affects @haxtheweb/haxcms-nodejs versions < 26.0.0. Fixed in 26.0.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
HAX CMS is an open-source content management system designed for creating and managing web content easily. It provides a user-friendly interface and supports various multimedia elements, making it suitable for developers and non-developers alike. However, it has a critical vulnerability that allows stored cross-site scripting (XSS) attacks through improper sanitization of <iframe> elements, which can lead to significant security risks.
Vulnerability Detail
The vulnerability arises from the application's failure to properly sanitize <iframe> elements, allowing the inclusion of 'javascript:' URIs in the src attribute. When a malicious page is accessed, this can execute arbitrary JavaScript in the victim's browser context. This exploitation can lead to unauthorized access to sensitive client-side data such as authentication tokens, session cookies, and user-specific information, ultimately enabling attackers to hijack user sessions and take over accounts.
How To Fix
Minimum fixed version
26.0.0
This is the first release that contains the fix.
npm install @haxtheweb/haxcms-nodejs@26.0.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using <iframe> elements with 'javascript:' URIs in the src attribute until the packages are updated. Additionally, consider implementing Content Security Policy (CSP) headers to mitigate the risk of XSS attacks.
Conclusion
The stored XSS vulnerability in HAX CMS poses a significant risk to users by allowing attackers to execute arbitrary JavaScript and access sensitive client-side data. It is crucial to update the affected packages to the patched versions to mitigate this risk and protect user accounts.
See every vulnerability recorded for @haxtheweb/haxcms-nodejs →
FAQ
Stored XSS is a type of security vulnerability where an attacker injects malicious scripts into a web application, which are then stored on the server and executed in the browsers of users who access the affected content.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. By checking your package-lock.json file, you can identify if your application is affected by this vulnerability.
The impacts include unauthorized access to sensitive data, session hijacking, and full account takeover, which can compromise user accounts and site content.
Yes, you can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The CVSS score of this vulnerability is 8.6, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for @haxtheweb/haxcms-nodejs.
