Executive brief
HAX CMS is a content management system used to build and manage microsites. A security flaw allows an attacker with basic posting privileges to embed malicious code into a page that executes when other users, including administrators, view it. This could lead to the theft of login tokens, session hijacking, and full account takeover, potentially compromising the entire website and its data.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in HAX CMS (PHP and Node.js versions) prior to 26.0.0. The root cause is improper sanitization of `<iframe>` elements, specifically allowing `javascript:` URIs and malicious `srcdoc` attributes. An authenticated attacker can inject a crafted iframe into a page; when viewed by others, the script executes in the context of the victim's browser. Because the application exposes sensitive data like JWTs in `window.appSettings`, an attacker can perform session hijacking or unauthorized API actions. The issue is fixed in version 26.0.0.
Affected products
- haxtheweb HAX CMS < 26.0.0
- haxtheweb haxcms-nodejs <= 25.0.0
- haxtheweb haxcms-php <= 25.0.0
- haxtheweb iframe-loader <= 25.0.0
- haxtheweb video-player <= 25.0.0
Timeline
- 2026-05-12: advisory: GitHub security advisory published
- 2026-06-05: disclosed: NVD publication date