Stored XSS via <iframe> in HAX CMS allows access to sensitive client-side data and account takeover
Description
Summary
A stored cross-site scripting (XSS) vulnerability exists in HAX CMS due to improper sanitization of `` elements.
The application allows javascript: URIs in the src attribute, which are executed when a malicious page is viewed. This enables attackers to execute arbitrary JavaScript in the context of the victim’s browser and access sensitive data exposed to client-side scripts.
Details
Successful exploitation allows access to any data available in the browser context, including:
- Authentication tokens (e.g., JWT)
- Session cookies (if not protected with HttpOnly)
- Application configuration (e.g., window.appSettings)
- User-specific data accessible via APIs
This significantly increases the impact beyond simple script execution.
PoC
Steps to reproduce:
- Log in to HAX CMS as any authenticated user.
- Create a new page or edit an existing page.
- Open the HTML source editor (
<>). - Insert the following payload:
Impact
This vulnerability allows stored XSS leading to:
- Execution of arbitrary JavaScript in victim browsers
- Access to sensitive client-side data, including authentication tokens and session identifiers
- Unauthorized API actions performed on behalf of the victim
- Session hijacking and full account takeover
Because the application exposes authentication data in the client-side environment, exploitation of this vulnerability can lead to complete compromise of user accounts and site content.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
A stored XSS vulnerability in HAX CMS allows attackers to execute arbitrary JavaScript via crafted elements, leading to account takeover.
Vulnerability
A stored cross-site scripting (XSS) vulnerability exists in HAX CMS due to improper sanitization of ` elements [1], [2], [3]. The application allows javascript: URIs in the src attribute and does not properly filter srcdoc content, enabling attackers to inject arbitrary JavaScript [2], [3]. The vulnerability affects all versions up to and including 25.0.0 of the @haxtheweb/haxcms-nodejs, @haxtheweb/iframe-loader, and @haxtheweb/video-player` npm packages [2], [3].
Exploitation
An authenticated user can trigger the vulnerability by creating or editing a page and inserting a crafted ` element with a srcdoc` attribute containing malicious script [2], [3]. The payload executes in the context of the victim's browser when the malicious page is viewed, requiring no additional user interaction beyond viewing the affected page [2], [3].
Impact
Successful exploitation allows an attacker to execute arbitrary JavaScript in the victim's browser, accessing sensitive client-side data such as authentication tokens (e.g., JWT), session cookies (if not protected with HttpOnly), application configuration (window.appSettings), and user-specific data accessible via APIs [2], [3]. This can lead to unauthorized API actions, session hijacking, and full account takeover [2], [3].
Mitigation
As of the publication date, no fix has been released. The affected versions are @haxtheweb/haxcms-nodejs, @haxtheweb/iframe-loader, and @haxtheweb/video-player all up to and including 25.0.0 [2], [3]. Administrators should monitor the official repository for patch announcements and consider restricting HTML editing capabilities to trusted users as a workaround until a fix is available [1], [2].
AI Insight generated on May 21, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.
Affected products
2Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
2News mentions
0No linked articles in our index yet.