Executive brief
HAX CMS is a content management system used to create and manage websites. The video-player component fails to properly validate URLs in the source attribute, allowing authenticated users to inject malicious JavaScript code that executes in the browsers of anyone viewing the compromised page. An attacker can steal authentication tokens, hijack user sessions, or compromise administrator accounts, potentially leading to full control of the CMS.
Technical details
The vulnerability is a stored XSS (CWE-79, CWE-116) in the <video-player> web component used within HAX CMS. The component fails to validate or sanitize URIs in the source and source-data attributes, allowing attackers to inject javascript: scheme URIs that execute arbitrary code. An authenticated user can insert a malicious video-player tag in the HTML editor (e.g., <video-player source="javascript:alert(...)">) that persists in the database and executes in the browser of any user viewing the page, including administrators. This enables theft of JWT tokens from localStorage, session hijacking, and account takeover. The vulnerability requires user authentication and victim interaction (page view), but affects all previous versions before 26.0.0 of @haxtheweb/haxcms-nodejs, @haxtheweb/video-player, and haxcms-php. A patch is available in version 26.0.0.
Affected products
- HAX @haxtheweb/haxcms-nodejs <= 25.0.0
- HAX @haxtheweb/video-player <= 25.0.0
- HAX haxcms-php <= 25.0.0
Timeline
- 2026-05-19: disclosed: Vulnerability published as GHSA-2m6p-hm3w-6jm3
- 2026-05-19: patched: Fix released in version 26.0.0