CVE-2026-46496: HAX CMS Cross-Site Scripting Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-2m6p-hm3w-6jm3",
  "modified" : "2026-06-09T11:56:45Z",
  "published" : "2026-05-19T14:44:34Z",
  "aliases" : [ "CVE-2026-46496" ],
  "summary" : "HAX CMS: Stored XSS via '<video-player>' component allows arbitrary JavaScript execution and token theft",
  "details" : "### Summary\nA stored cross-site scripting (XSS) vulnerability exists in HAX CMS due to improper sanitization of the `<video-player>` component.\n\nThe component allows `javascript:` URIs in the `source` attribute, which are executed when the page is viewed. This enables attackers to execute arbitrary JavaScript in the context of the victim’s browser and access sensitive data such as JWT tokens and more.\n\n### Details\nThe vulnerability is present in the `<video-player>` web component used within the HAX CMS editor.\n\nThe application fails to validate or sanitize user-supplied input in the following attributes:\n- `source`\n- `source-data`\n\nThese attributes accept arbitrary URI schemes, including `javascript:`, which leads to execution of attacker-controlled JavaScript in the browser.\n\nExample vulnerable usage:\n```html\n<video-player \n  source=\"javascript:alert(document.domain)\" \n  source-type=\"external\">\n</video-player>\n```\n\n\nBecause this content is stored and rendered to other users, the vulnerability is classified as a stored XSS.\n\nThe root cause is the lack of URI scheme validation and improper sanitization of component attributes before rendering.\nBecause this content is stored and rendered to other users, the vulnerability is classified as a stored XSS.\n\nThe root cause is the lack of URI scheme validation and improper sanitization of component attributes before rendering.\n\n\n### PoC\n\nSteps to reproduce:\n1. Log in to HAX CMS as user.\n2. Create a website or any page and switch to the HTML source editor (`<>`).\n3. Insert the following payload:\n\n```html\n<video-player source=\"javascript:alert('JWT: '+localStorage.getItem('jwt').substring(0,30))\" source-type=\"external\"></video-player>\n```\n<img width=\"2456\" height=\"1405\" alt=\"image\" src=\"https://github.com/user-attachments/assets/ea037043-7ff7-4840-bed0-1091692c6289\" />\n\n\nSave the page.\n\nReload or revisit or send the page.\n\nResult\n<img width=\"2468\" height=\"1394\" alt=\"image\" src=\"https://github.com/user-attachments/assets/543bbf69-900d-4e2d-bd6b-0658fb5aa899\" />\n\n\nA JavaScript alert executes.\nThe JWT token is exposed.\nThis confirms arbitrary JavaScript execution in the victim’s browser.\n\n\n### Impact\n\nThis vulnerability allows stored XSS leading to:\n\n- Theft of JWT authentication tokens \n- Session hijacking\n- Full account takeover\n- Execution of arbitrary JavaScript in victim browsers\n\nIf an administrator views a malicious page, this can lead to full CMS compromise.\n\nAttack complexity: Low  \nPrivileges required: Low (any authenticated user)  \nUser interaction: Required",
  "severity" : [ {
    "type" : "CVSS_V4",
    "score" : "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "npm",
      "name" : "@haxtheweb/haxcms-nodejs"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "26.0.0"
      } ]
    } ],
    "database_specific" : {
      "last_known_affected_version_range" : "<= 25.0.0"
    }
  }, {
    "package" : {
      "ecosystem" : "npm",
      "name" : "@haxtheweb/video-player"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "26.0.0"
      } ]
    } ],
    "database_specific" : {
      "last_known_affected_version_range" : "<= 25.0.0"
    }
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/haxtheweb/issues/security/advisories/GHSA-2m6p-hm3w-6jm3"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-46496"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/haxtheweb/issues"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-116", "CWE-79" ],
    "severity" : "MODERATE",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-05-19T14:44:34Z",
    "nvd_published_at" : "2026-06-05T19:16:34Z"
  }
}