{
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "HAX CMS helps manage microsite universe with PHP or NodeJs backends. A stored cross-site scripting (XSS) vulnerability exists in versions prior to 26.0.0 due to improper sanitization of `\u003ciframe\u003e` elements. The application allows `javascript:` URIs in the `src` attribute, which are executed when a malicious page is viewed. This enables attackers to execute arbitrary JavaScript in the context of the victim\u2019s browser and access sensitive data exposed to client-side scripts. Version 26.0.0 fixes the issue."
    }
  ],
  "id": "CVE-2026-46396",
  "lastModified": "2026-06-05T19:20:19.607",
  "metrics": {
    "cvssMetricV40": [
      {
        "cvssData": {
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "attackVector": "NETWORK",
          "availabilityRequirement": "NOT_DEFINED",
          "baseScore": 9.3,
          "baseSeverity": "CRITICAL",
          "confidentialityRequirement": "NOT_DEFINED",
          "exploitMaturity": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "privilegesRequired": "LOW",
          "providerUrgency": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "HIGH",
          "subIntegrityImpact": "HIGH",
          "userInteraction": "PASSIVE",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "version": "4.0",
          "vulnAvailabilityImpact": "NONE",
          "vulnConfidentialityImpact": "HIGH",
          "vulnIntegrityImpact": "HIGH",
          "vulnerabilityResponseEffort": "NOT_DEFINED"
        },
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-06-05T19:16:33.750",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/haxtheweb/issues/security/advisories/GHSA-jh3h-rpxg-fr36"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Primary"
    }
  ]
}

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 25.0.0"
      },
      "package": {
        "ecosystem": "npm",
        "name": "@haxtheweb/haxcms-nodejs"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "26.0.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 25.0.0"
      },
      "package": {
        "ecosystem": "npm",
        "name": "@haxtheweb/video-player"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "26.0.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 25.0.0"
      },
      "package": {
        "ecosystem": "npm",
        "name": "@haxtheweb/iframe-loader"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "26.0.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-46396"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-79"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-05-19T14:46:47Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "### Summary\nA stored cross-site scripting (XSS) vulnerability exists in HAX CMS due to improper sanitization of `\u003ciframe\u003e` elements.\n\nThe application allows `javascript:` URIs in the `src` attribute, which are executed when a malicious page is viewed. This enables attackers to execute arbitrary JavaScript in the context of the victim\u2019s browser and access sensitive data exposed to client-side scripts.\n\n### Details\nSuccessful exploitation allows access to any data available in the browser context, including:\n\n- Authentication tokens (e.g., JWT)\n- Session cookies (if not protected with HttpOnly)\n- Application configuration (e.g., window.appSettings)\n- User-specific data accessible via APIs\n\nThis significantly increases the impact beyond simple script execution.\n\n### PoC\nSteps to reproduce:\n\n1. Log in to HAX CMS as any authenticated user.\n2. Create a new page or edit an existing page.\n3. Open the HTML source editor (`\u003c\u003e`).\n4. Insert the following payload:\n\n```html\n\u003ciframe srcdoc=\"\u0026lt;script\u0026gt;\n    (function(){\n        try {\n            var jwt = parent.window.appSettings.jwt;\n            alert(\u0027Stolen JWT:\\n\u0027 + jwt);\n        } catch(e) {\n            alert(\u0027Error: \u0027 + e.message);\n        }\n    })();\n\u0026lt;/script\u0026gt;\" style=\"display:none\" sandbox=\"allow-scripts allow-same-origin\"\u003e\u003c/iframe\u003e\n```\n\u003cimg width=\"2446\" height=\"1319\" alt=\"image\" src=\"https://github.com/user-attachments/assets/daea3b41-8c72-4f6c-ab32-34c688bbd251\" /\u003e\n\n\n\u003cimg width=\"2464\" height=\"1397\" alt=\"image\" src=\"https://github.com/user-attachments/assets/911cbd42-db50-454a-b178-51555e0db79c\" /\u003e\n\n\n\n\u003cimg width=\"2466\" height=\"1409\" alt=\"webhook`\" src=\"https://github.com/user-attachments/assets/8a286435-98f4-418c-a596-d0c19556696a\" /\u003e\n\n### Impact\nThis vulnerability allows stored XSS leading to:\n\n- Execution of arbitrary JavaScript in victim browsers\n- Access to sensitive client-side data, including authentication tokens and session identifiers\n- Unauthorized API actions performed on behalf of the victim\n- Session hijacking and full account takeover\n\nBecause the application exposes authentication data in the client-side environment, exploitation of this vulnerability can lead to complete compromise of user accounts and site content.",
  "id": "GHSA-jh3h-rpxg-fr36",
  "modified": "2026-05-19T14:46:47Z",
  "published": "2026-05-19T14:46:47Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/haxtheweb/issues/security/advisories/GHSA-jh3h-rpxg-fr36"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/haxtheweb/issues"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Stored XSS via \u003ciframe\u003e in HAX CMS allows access to sensitive client-side data and account takeover"
}