Critical severityGHSA Advisory· Published Jun 5, 2026· Updated Jun 9, 2026

CVE-2026-46396

Description

HAX CMS helps manage microsite universe with PHP or NodeJs backends. A stored cross-site scripting (XSS) vulnerability exists in versions prior to 26.0.0 due to improper sanitization of ` elements. The application allows javascript: URIs in the src` attribute, which are executed when a malicious page is viewed. This enables attackers to execute arbitrary JavaScript in the context of the victim’s browser and access sensitive data exposed to client-side scripts. Version 26.0.0 fixes the issue.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
@haxtheweb/haxcms-nodejsnpm	< 26.0.0	26.0.0
@haxtheweb/video-playernpm	< 26.0.0	26.0.0
@haxtheweb/iframe-loadernpm	< 26.0.0	26.0.0

Affected products

Haxtheweb/Open ApisGHSA
Range: <= 25.0.0

Patches

Vulnerability mechanics

References

github.com/advisories/GHSA-jh3h-rpxg-fr36ghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2026-46396ghsaADVISORY
github.com/haxtheweb/issuesghsaPACKAGE
github.com/haxtheweb/issues/security/advisories/GHSA-jh3h-rpxg-fr36nvdWEB

News mentions

HAX CMS: 15 Vulnerabilities Disclosed Together on June 5, 2026
Vypr Intelligence · Jun 5, 2026

cvss	0.585
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000