CVE-2026-46496
NoneCVSS
—
EPSS
0.4%
Published
Jun 5, 2026
CISA due date
—
The record
HAX CMS helps manage microsite universe with PHP or NodeJs backends. A stored cross-site scripting (XSS) vulnerability exists in versions prior to 26.0.0 due to improper sanitization of the `<video-player>` component. The component allows `javascript:` URIs in the `source` attribute, which are executed when the page is viewed. This enables attackers to execute arbitrary JavaScript in the context of the victim’s browser and access sensitive data such as JWT tokens and more. Version 26.0.0 fixes the issue.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | @haxtheweb/haxcms-nodejs | 0 | 26.0.0 |
| npm | @haxtheweb/video-player | 0 | 26.0.0 |
Related vulnerabilities
- GHSA-2m6p-hm3w-6jm3 HAX CMS: Stored XSS via '' component allows arbitrary JavaScript execution and token theft Same vulnerability
- CVE-2026-46357 HAX CMS helps manage microsite universe with PHP or NodeJs backends. Also affects @haxtheweb/haxcms-nodejs
- CVE-2026-46511 HAX CMS helps manage microsite universe with PHP or NodeJs backends. Also affects @haxtheweb/haxcms-nodejs
- CVE-2026-46395 HAX CMS helps manage microsite universe with PHP or NodeJs backends. Also affects @haxtheweb/haxcms-nodejs
- CVE-2026-46393 HAX CMS helps manage microsite universe with PHP or NodeJs backends. Also affects @haxtheweb/haxcms-nodejs
- CVE-2026-46396 HAX CMS helps manage microsite universe with PHP or NodeJs backends. Also affects @haxtheweb/haxcms-nodejs
- GHSA-g2g8-95qg-v35h HaxCMS has a stored Cross-Site Scripting (XSS) bypass in its saveNode endpoint Also affects @haxtheweb/haxcms-nodejs
- CVE-2026-48527 HAX CMS helps manage microsite universe with PHP or NodeJs backends. Also affects @haxtheweb/haxcms-nodejs