{"id":"CVE-2026-46396","aliases":["EUVD-2026-34891","GHSA-jh3h-rpxg-fr36"],"status":"published","title":"HAX CMS has a stored XSS via \u003ciframe\u003e that allows access to sensitive client-side data and account takeover","description":"HAX CMS helps manage microsite universe with PHP or NodeJs backends. A stored cross-site scripting (XSS) vulnerability exists in versions prior to 26.0.0 due to improper sanitization of `\u003ciframe\u003e` elements. The application allows `javascript:` URIs in the `src` attribute, which are executed when a malicious page is viewed. This enables attackers to execute arbitrary JavaScript in the context of the victim’s browser and access sensitive data exposed to client-side scripts. Version 26.0.0 fixes the issue.","severity":{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.0023,"percentile":0.1391,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2026-05-19T14:46:47Z","modified":"2026-09-10T03:51:06Z","fixes":[{"ecosystem":"npm","package":"@haxtheweb/haxcms-nodejs","fixed_in":["26.0.0"],"sources":["ghsa","osv"]},{"ecosystem":"npm","package":"@haxtheweb/video-player","fixed_in":["26.0.0"],"sources":["ghsa","osv"]},{"ecosystem":"npm","package":"@haxtheweb/iframe-loader","fixed_in":["26.0.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"@haxtheweb/haxcms-nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"25.0.0"},{"fixed":"26.0.0"}]}]},{"source":"ghsa","ecosystem":"npm","package":"@haxtheweb/video-player","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"25.0.0"},{"fixed":"26.0.0"}]}]},{"source":"ghsa","ecosystem":"npm","package":"@haxtheweb/iframe-loader","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"25.0.0"},{"fixed":"26.0.0"}]}]},{"source":"osv","ecosystem":"npm","package":"@haxtheweb/haxcms-nodejs","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"26.0.0"}]}]},{"source":"osv","ecosystem":"npm","package":"@haxtheweb/video-player","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"26.0.0"}]}]},{"source":"osv","ecosystem":"npm","package":"@haxtheweb/iframe-loader","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"26.0.0"}]}]}],"products":[{"vendor":"haxtheweb","product":"haxcms-nodejs"},{"vendor":"haxtheweb","product":"iframe-loader"},{"vendor":"haxtheweb","product":"video-player"}],"references":[{"url":"https://github.com/haxtheweb/issues/security/advisories/GHSA-jh3h-rpxg-fr36","tags":["x_refsource_CONFIRM","exploit","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-46396","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-jh3h-rpxg-fr36"},{"url":"https://github.com/haxtheweb/issues","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-46396","title":"HAX CMS has a stored XSS via \u003ciframe\u003e that allows access to sensitive client-side data and account takeover","description":"HAX CMS helps manage microsite universe with PHP or NodeJs backends. A stored cross-site scripting (XSS) vulnerability exists in versions prior to 26.0.0 due to improper sanitization of `\u003ciframe\u003e` elements. The application allows `javascript:` URIs in the `src` attribute, which are executed when a malicious page is viewed. This enables attackers to execute arbitrary JavaScript in the context of the victim’s browser and access sensitive data exposed to client-side scripts. Version 26.0.0 fixes the issue.","status":"published","published":"2026-06-05T18:44:28.997Z","modified":"2026-06-09T14:36:27.436Z","cvss":[{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N","level":"critical","assessor":"cna"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T13:47:06.353366Z"}],"euvd":[{"id":"EUVD-2026-34891","description":"HAX CMS helps manage microsite universe with PHP or NodeJs backends. A stored cross-site scripting (XSS) vulnerability exists in versions prior to 26.0.0 due to improper sanitization of `\u003ciframe\u003e` elements. The application allows `javascript:` URIs in the `src` attribute, which are executed when a malicious page is viewed. This enables attackers to execute arbitrary JavaScript in the context of the victim’s browser and access sensitive data exposed to client-side scripts. Version 26.0.0 fixes the issue.","status":"published","published":"2026-06-05T18:44:28Z","modified":"2026-06-09T14:36:27Z","cvss":[{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N","level":"critical"}],"updated_at":"2026-11-02T18:20:47.64718Z"}],"ghsa":[{"id":"GHSA-jh3h-rpxg-fr36","title":"Stored XSS via \u003ciframe\u003e in HAX CMS allows access to sensitive client-side data and account takeover","description":"### Summary\nA stored cross-site scripting (XSS) vulnerability exists in HAX CMS due to improper sanitization of `\u003ciframe\u003e` elements.\n\nThe application allows `javascript:` URIs in the `src` attribute, which are executed when a malicious page is viewed. This enables attackers to execute arbitrary JavaScript in the context of the victim’s browser and access sensitive data exposed to client-side scripts.\n\n### Details\nSuccessful exploitation allows access to any data available in the browser context, including:\n\n- Authentication tokens (e.g., JWT)\n- Session cookies (if not protected with HttpOnly)\n- Application configuration (e.g., window.appSettings)\n- User-specific data accessible via APIs\n\nThis significantly increases the impact beyond simple script execution.\n\n### PoC\nSteps to reproduce:\n\n1. Log in to HAX CMS as any authenticated user.\n2. Create a new page or edit an existing page.\n3. Open the HTML source editor (`\u003c\u003e`).\n4. Insert the following payload:\n\n```html\n\u003ciframe srcdoc=\"\u0026lt;script\u0026gt;\n    (function(){\n        try {\n            var jwt = parent.window.appSettings.jwt;\n            alert('Stolen JWT:\\n' + jwt);\n        } catch(e) {\n            alert('Error: ' + e.message);\n        }\n    })();\n\u0026lt;/script\u0026gt;\" style=\"display:none\" sandbox=\"allow-scripts allow-same-origin\"\u003e\u003c/iframe\u003e\n```\n\u003cimg width=\"2446\" height=\"1319\" alt=\"image\" src=\"https://github.com/user-attachments/assets/daea3b41-8c72-4f6c-ab32-34c688bbd251\" /\u003e\n\n\n\u003cimg width=\"2464\" height=\"1397\" alt=\"image\" src=\"https://github.com/user-attachments/assets/911cbd42-db50-454a-b178-51555e0db79c\" /\u003e\n\n\n\n\u003cimg width=\"2466\" height=\"1409\" alt=\"webhook`\" src=\"https://github.com/user-attachments/assets/8a286435-98f4-418c-a596-d0c19556696a\" /\u003e\n\n### Impact\nThis vulnerability allows stored XSS leading to:\n\n- Execution of arbitrary JavaScript in victim browsers\n- Access to sensitive client-side data, including authentication tokens and session identifiers\n- Unauthorized API actions performed on behalf of the victim\n- Session hijacking and full account takeover\n\nBecause the application exposes authentication data in the client-side environment, exploitation of this vulnerability can lead to complete compromise of user accounts and site content.","status":"published","published":"2026-05-19T14:46:47Z","modified":"2026-06-09T11:56:54Z","cvss":[{"version":"4.0","score":8.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:40:23.739691Z"}],"nvd":[{"id":"CVE-2026-46396","description":"HAX CMS helps manage microsite universe with PHP or NodeJs backends. A stored cross-site scripting (XSS) vulnerability exists in versions prior to 26.0.0 due to improper sanitization of `\u003ciframe\u003e` elements. The application allows `javascript:` URIs in the `src` attribute, which are executed when a malicious page is viewed. This enables attackers to execute arbitrary JavaScript in the context of the victim’s browser and access sensitive data exposed to client-side scripts. Version 26.0.0 fixes the issue.","status":"published","published":"2026-06-05T19:16:33.75Z","modified":"2026-06-17T10:53:38.283Z","cvss":[{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"critical","assessor":"secondary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:12:22.73178Z"}],"osv":[{"id":"GHSA-jh3h-rpxg-fr36","title":"Stored XSS via \u003ciframe\u003e in HAX CMS allows access to sensitive client-side data and account takeover","description":"### Summary\nA stored cross-site scripting (XSS) vulnerability exists in HAX CMS due to improper sanitization of `\u003ciframe\u003e` elements.\n\nThe application allows `javascript:` URIs in the `src` attribute, which are executed when a malicious page is viewed. This enables attackers to execute arbitrary JavaScript in the context of the victim’s browser and access sensitive data exposed to client-side scripts.\n\n### Details\nSuccessful exploitation allows access to any data available in the browser context, including:\n\n- Authentication tokens (e.g., JWT)\n- Session cookies (if not protected with HttpOnly)\n- Application configuration (e.g., window.appSettings)\n- User-specific data accessible via APIs\n\nThis significantly increases the impact beyond simple script execution.\n\n### PoC\nSteps to reproduce:\n\n1. Log in to HAX CMS as any authenticated user.\n2. Create a new page or edit an existing page.\n3. Open the HTML source editor (`\u003c\u003e`).\n4. Insert the following payload:\n\n```html\n\u003ciframe srcdoc=\"\u0026lt;script\u0026gt;\n    (function(){\n        try {\n            var jwt = parent.window.appSettings.jwt;\n            alert('Stolen JWT:\\n' + jwt);\n        } catch(e) {\n            alert('Error: ' + e.message);\n        }\n    })();\n\u0026lt;/script\u0026gt;\" style=\"display:none\" sandbox=\"allow-scripts allow-same-origin\"\u003e\u003c/iframe\u003e\n```\n\u003cimg width=\"2446\" height=\"1319\" alt=\"image\" src=\"https://github.com/user-attachments/assets/daea3b41-8c72-4f6c-ab32-34c688bbd251\" /\u003e\n\n\n\u003cimg width=\"2464\" height=\"1397\" alt=\"image\" src=\"https://github.com/user-attachments/assets/911cbd42-db50-454a-b178-51555e0db79c\" /\u003e\n\n\n\n\u003cimg width=\"2466\" height=\"1409\" alt=\"webhook`\" src=\"https://github.com/user-attachments/assets/8a286435-98f4-418c-a596-d0c19556696a\" /\u003e\n\n### Impact\nThis vulnerability allows stored XSS leading to:\n\n- Execution of arbitrary JavaScript in victim browsers\n- Access to sensitive client-side data, including authentication tokens and session identifiers\n- Unauthorized API actions performed on behalf of the victim\n- Session hijacking and full account takeover\n\nBecause the application exposes authentication data in the client-side environment, exploitation of this vulnerability can lead to complete compromise of user accounts and site content.","status":"published","published":"2026-05-19T14:46:47Z","modified":"2026-09-10T03:51:06.237354969Z","cvss":[{"version":"4.0","score":8.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:46:50.336262Z"}]}}