CVE-2026-46396: @haxtheweb/haxcms nodejs Cross-Site Scripting Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-jh3h-rpxg-fr36",
  "modified" : "2026-06-09T11:56:54Z",
  "published" : "2026-05-19T14:46:47Z",
  "aliases" : [ "CVE-2026-46396" ],
  "summary" : "Stored XSS via <iframe> in HAX CMS allows access to sensitive client-side data and account takeover",
  "details" : "### Summary\nA stored cross-site scripting (XSS) vulnerability exists in HAX CMS due to improper sanitization of `<iframe>` elements.\n\nThe application allows `javascript:` URIs in the `src` attribute, which are executed when a malicious page is viewed. This enables attackers to execute arbitrary JavaScript in the context of the victim’s browser and access sensitive data exposed to client-side scripts.\n\n### Details\nSuccessful exploitation allows access to any data available in the browser context, including:\n\n- Authentication tokens (e.g., JWT)\n- Session cookies (if not protected with HttpOnly)\n- Application configuration (e.g., window.appSettings)\n- User-specific data accessible via APIs\n\nThis significantly increases the impact beyond simple script execution.\n\n### PoC\nSteps to reproduce:\n\n1. Log in to HAX CMS as any authenticated user.\n2. Create a new page or edit an existing page.\n3. Open the HTML source editor (`<>`).\n4. Insert the following payload:\n\n```html\n<iframe srcdoc=\"&lt;script&gt;\n    (function(){\n        try {\n            var jwt = parent.window.appSettings.jwt;\n            alert('Stolen JWT:\\n' + jwt);\n        } catch(e) {\n            alert('Error: ' + e.message);\n        }\n    })();\n&lt;/script&gt;\" style=\"display:none\" sandbox=\"allow-scripts allow-same-origin\"></iframe>\n```\n<img width=\"2446\" height=\"1319\" alt=\"image\" src=\"https://github.com/user-attachments/assets/daea3b41-8c72-4f6c-ab32-34c688bbd251\" />\n\n\n<img width=\"2464\" height=\"1397\" alt=\"image\" src=\"https://github.com/user-attachments/assets/911cbd42-db50-454a-b178-51555e0db79c\" />\n\n\n\n<img width=\"2466\" height=\"1409\" alt=\"webhook`\" src=\"https://github.com/user-attachments/assets/8a286435-98f4-418c-a596-d0c19556696a\" />\n\n### Impact\nThis vulnerability allows stored XSS leading to:\n\n- Execution of arbitrary JavaScript in victim browsers\n- Access to sensitive client-side data, including authentication tokens and session identifiers\n- Unauthorized API actions performed on behalf of the victim\n- Session hijacking and full account takeover\n\nBecause the application exposes authentication data in the client-side environment, exploitation of this vulnerability can lead to complete compromise of user accounts and site content.",
  "severity" : [ {
    "type" : "CVSS_V4",
    "score" : "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "npm",
      "name" : "@haxtheweb/haxcms-nodejs"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "26.0.0"
      } ]
    } ],
    "database_specific" : {
      "last_known_affected_version_range" : "<= 25.0.0"
    }
  }, {
    "package" : {
      "ecosystem" : "npm",
      "name" : "@haxtheweb/video-player"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "26.0.0"
      } ]
    } ],
    "database_specific" : {
      "last_known_affected_version_range" : "<= 25.0.0"
    }
  }, {
    "package" : {
      "ecosystem" : "npm",
      "name" : "@haxtheweb/iframe-loader"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "26.0.0"
      } ]
    } ],
    "database_specific" : {
      "last_known_affected_version_range" : "<= 25.0.0"
    }
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/haxtheweb/issues/security/advisories/GHSA-jh3h-rpxg-fr36"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-46396"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/haxtheweb/issues"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-79" ],
    "severity" : "HIGH",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-05-19T14:46:47Z",
    "nvd_published_at" : "2026-06-05T19:16:33Z"
  }
}