Vulnerability · Published Jun 5, 2026 · Assigned by GitHub_M
CVE-2026-46496HAX CMS: Stored XSS via '<video-player>' component allows arbitrary JavaScript execution and token theft
Critical 9.3
In plain English
A critical-severity cross-site scripting in haxcms-nodejs from haxtheweb. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 14% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
HAX CMS helps manage microsite universe with PHP or NodeJs backends. A stored cross-site scripting (XSS) vulnerability exists in versions prior to 26.0.0 due to improper sanitization of the `<video-player>` component. The component allows `javascript:` URIs in the `source` attribute, which are executed when the page is viewed. This enables attackers to execute arbitrary JavaScript in the context of the victim’s browser and access sensitive data such as JWT tokens and more. Version 26.0.0 fixes the issue.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| npm | @haxtheweb/haxcms-nodejs | 26.0.0 | GHSA-2m6p-hm3w-6jm3 |
| npm | @haxtheweb/video-player | 26.0.0 | GHSA-2m6p-hm3w-6jm3 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| haxtheweb | haxcms-nodejs | < 26.0.0 |
| haxtheweb | video-player | < 26.0.0 |
Weakness: CWE-79, CWE-116 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N
References
- https://github.com/haxtheweb/issues/security/advisories/GHSA-2m6p-hm3w-6jm3 x_refsource_CONFIRM