Is CVE-2026-46496 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-46496 being exploited in the wild.

How severe is CVE-2026-46496?

Medium severity, with a CVSS score of 4, published 5 June 2026.

Which products and versions are affected?

Haxtheweb HAX CMS < 26.0.0, <= 25.0.0; Haxtheweb Haxcms-Nodejs <= 25.0.0; Haxtheweb Haxcms-Php <= 25.0.0; Haxtheweb Video-Player <= 25.0.0; and 2 more.

Is there a fix for CVE-2026-46496?

Yes. @haxtheweb/haxcms-nodejs (npm): upgrade to 26.0.0 or later; @haxtheweb/video-player (npm): upgrade to 26.0.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-46496 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-46496?

Check whether you run Haxtheweb HAX CMS, Haxtheweb Haxcms-Nodejs, Haxtheweb Haxcms-Php or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-46496: haxtheweb HAX CMS stored XSS in video-player component

Q: Which products and versions are affected?

Haxtheweb HAX CMS < 26.0.0, <= 25.0.0; Haxtheweb Haxcms-Nodejs <= 25.0.0; Haxtheweb Haxcms-Php <= 25.0.0; Haxtheweb Video-Player <= 25.0.0; and 2 more.

Q: Is there a fix for CVE-2026-46496?

Yes. @haxtheweb/haxcms-nodejs (npm): upgrade to 26.0.0 or later; @haxtheweb/video-player (npm): upgrade to 26.0.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-46496 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-46496?

Check whether you run Haxtheweb HAX CMS, Haxtheweb Haxcms-Nodejs, Haxtheweb Haxcms-Php or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-46496 · Severity: medium · CVSS 4 · Published 2026-06-05

HAX CMS is a content management system used to create and manage websites. The video-player component fails to properly validate URLs in the source attribute, allowing authenticated users to inject malicious JavaScript code that executes in the browsers of anyone viewing the compromised page. An attacker can steal authentication tokens, hijack user sessions, or compromise administrator accounts, potentially leading to full control of the CMS.

Technologies: Haxtheweb HAX CMS, Haxtheweb Haxcms-Nodejs, Haxtheweb Haxcms-Php, @haxtheweb/haxcms-nodejs (npm). Vendors: Haxtheweb, npm.

Quick answers

Is CVE-2026-46496 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-46496 being exploited in the wild.
How severe is CVE-2026-46496?: Medium severity, with a CVSS score of 4, published 5 June 2026.
Which products and versions are affected?: Haxtheweb HAX CMS < 26.0.0, <= 25.0.0; Haxtheweb Haxcms-Nodejs <= 25.0.0; Haxtheweb Haxcms-Php <= 25.0.0; Haxtheweb Video-Player <= 25.0.0; and 2 more.
Is there a fix for CVE-2026-46496?: Yes. @haxtheweb/haxcms-nodejs (npm): upgrade to 26.0.0 or later; @haxtheweb/video-player (npm): upgrade to 26.0.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-46496 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-46496?: Check whether you run Haxtheweb HAX CMS, Haxtheweb Haxcms-Nodejs, Haxtheweb Haxcms-Php or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

@haxtheweb/haxcms-nodejs (npm): upgrade to 26.0.0 or later
```
npm install @haxtheweb/haxcms-nodejs@26.0.0
```
@haxtheweb/video-player (npm): upgrade to 26.0.0 or later
```
npm install @haxtheweb/video-player@26.0.0
```

Technical details

The vulnerability is a stored XSS (CWE-79, CWE-116) in the <video-player> web component used within HAX CMS. The component fails to validate or sanitize URIs in the source and source-data attributes, allowing attackers to inject javascript: scheme URIs that execute arbitrary code. An authenticated user can insert a malicious video-player tag in the HTML editor (e.g., <video-player source="javascript:alert(...)">) that persists in the database and executes in the browser of any user viewing the page, including administrators. This enables theft of JWT tokens from localStorage, session hijacking, and account takeover. The vulnerability requires user authentication and victim interaction (page view), but affects all previous versions before 26.0.0 of @haxtheweb/haxcms-nodejs, @haxtheweb/video-player, and haxcms-php. A patch is available in version 26.0.0.

Affected products

HAX @haxtheweb/haxcms-nodejs <= 25.0.0
HAX @haxtheweb/video-player <= 25.0.0
HAX haxcms-php <= 25.0.0

Identifiers

CVE-2026-46496
GHSA-2m6p-hm3w-6jm3

Timeline

2026-05-19: disclosed: Vulnerability published as GHSA-2m6p-hm3w-6jm3
2026-05-19: patched: Fix released in version 26.0.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.