CVE-2026-48527
CVE-2026-48527 · HaxCMS has a stored Cross-Site Scripting (XSS) bypass in saveNode endpoint
This page contains facts from public vulnerability sources. Check the original advisory before updating.
HAX CMS helps manage microsite universe with PHP or NodeJs backends. Versions up to and including 26.0.0 are affected by a stored cross-site scripting (XSS) vulnerability in the `/system/api/saveNode` endpoint. An authenticated user with a permission to edit pages can bypass the HTML sanitizer by injecting an event handler attribute without whitespace before the attribute name. @haxtheweb/haxcms-nodejs 26.0.1 and haxcms-php 26.0.2 patch the issue.
CVSS 8.7 · High · EPSS 0.2% · Fix available
- Published
- Updated
Stack: node
Affected products and versions
haxcms-nodejs
- Versions
- < 26.0.1: Affected
No fix published
haxcms-php
- Versions
- < 26.0.2: Affected
No fix published
@haxtheweb/haxcms-nodejs npm
- Affected ranges
- SEMVER: < 26.0.1
Update to 26.0.1