CVE-2025-54128: HAX CMS NodeJs XSS Vulnerability

CVE-2025-54128 Overview

CVE-2025-54128 affects HAX CMS NodeJs, a Node.js-based content management system for managing microsite universes. In versions 11.0.7 and below, the application ships with the Helmet middleware's contentSecurityPolicy value explicitly disabled in app.js. Without a Content Security Policy (CSP), the application does not restrict where scripts, styles, or other resources can be loaded from. This significantly weakens the browser's built-in defenses against cross-site scripting (XSS) attacks [CWE-79]. The issue is resolved in version 11.0.8, which introduces a default set of Helmet CSP directives.

Critical Impact
Attackers who identify an injection point in HAX CMS content can execute arbitrary JavaScript in visitors' browsers without CSP-based mitigation, enabling session theft and defacement.

Affected Products

HAX CMS NodeJs versions 11.0.7 and below
psu:haxcms-nodejs package distributed via node.js
Deployments using the default Helmet configuration shipped by the project

Discovery Timeline

2025-07-21 - CVE-2025-54128 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-54128

Vulnerability Analysis

HAX CMS NodeJs uses the Helmet middleware to set HTTP security headers on responses. In the affected versions, the maintainers explicitly set contentSecurityPolicy: false when initializing Helmet in src/app.js. This suppresses the default CSP header that Helmet would otherwise emit.

Without a CSP header, browsers apply no origin restrictions to inline scripts, remote scripts, event handlers, or embedded objects. Any reflected or stored XSS primitive in the CMS becomes directly exploitable in modern browsers. Because HAX CMS is designed to host user-authored microsites, the blast radius extends to every site published through an affected instance.

The CWE-79 classification aligns with the practical impact: CSP is a defense-in-depth control specifically intended to mitigate XSS payload execution when input validation fails.

Root Cause

The root cause is an insecure default in the Helmet configuration. The application explicitly disables CSP rather than tuning it, leaving production deployments without header-level XSS containment.

Attack Vector

Exploitation requires an attacker to introduce script content into a page served by HAX CMS, then convince a user to visit that page. The user interaction requirement is why the vector is classified as network-based with passive user involvement. Once loaded, injected scripts execute with the origin of the CMS and can access cookies, tokens, and DOM data.

javascript

// HAXcms core settings
process.env.haxcms_middleware = "node-express";
const { HAXCMS, systemStructureContext } = require('./lib/HAXCMS.js');
// default helmet policies for CSP
const helmetPolicies = {
  contentSecurityPolicy: {
    directives: {
      scriptSrc: ["'self'", "'unsafe-inline'", "'unsafe-eval'", "'wasm-unsafe-eval'", "www.youtube.com"],
      styleSrc: ["'self'", "'unsafe-inline'", "data:", "https:"],
      mediaSrc: ["'self'", "data:", "https:"],
      imgSrc: ["'self'", "data:", "https:"],
      connectSrc: ["'self'", "https:", "ws:"],
      defaultSrc: ["'self'", "data:", "https:"],
      objectSrc: ["'none'"],
      fontSrc: ["'self'", "data:", "fonts.gstatic.com"],
    },
  },
  referrerPolicy: {
    policy: ["origin", "unsafe-url"],
  },
};
// Source: https://github.com/haxtheweb/haxcms-nodejs/commit/ddb9351c6d6418008d4084a5b17fd6d611bc4e30

This patch snippet introduces the default CSP directives that were previously disabled. Note that scriptSrc still allows 'unsafe-inline' and 'unsafe-eval', so operators should tighten these values further for high-risk environments.

Detection Methods for CVE-2025-54128

Indicators of Compromise

Absence of a Content-Security-Policy response header on pages served by HAX CMS NodeJs
Unexpected <script> tags, inline event handlers, or javascript: URIs stored within site JSON or page content
Outbound browser requests from CMS visitors to attacker-controlled domains referenced in injected payloads

Detection Strategies

Fingerprint installed versions by checking the haxcms-nodejs package version against 11.0.8 or later
Perform HTTP header audits against the deployed CMS to confirm CSP headers are present and restrictive
Scan stored page content and site.json files for markup patterns consistent with XSS payloads

Monitoring Recommendations

Log and alert on responses missing the Content-Security-Policy header from CMS hosts
Monitor web server access logs for anomalous query strings and referers targeting HAX CMS endpoints
Track outbound network telemetry from client workstations for connections to unknown domains sourced from CMS pages

How to Mitigate CVE-2025-54128

Immediate Actions Required

Upgrade haxcms-nodejs to version 11.0.8 or later, which enables the default Helmet CSP directives
Review any local overrides of the Helmet configuration to ensure contentSecurityPolicy is not disabled
Audit existing microsite content for stored XSS payloads that may have been introduced while CSP was absent

Patch Information

The fix is delivered in commit ddb9351c6d6418008d4084a5b17fd6d611bc4e30, referenced by GitHub Security Advisory GHSA-59g8-h59f-8hjp and available in the upstream commit. Upgrading to version 11.0.8 restores CSP enforcement.

Workarounds

Deploy a reverse proxy such as nginx or a WAF that injects a restrictive Content-Security-Policy response header ahead of the CMS
Remove or override the contentSecurityPolicy: false setting in the local src/app.js and replace it with explicit directives
Restrict authoring access to trusted users and enforce content review workflows until patched

bash

# nginx snippet to add a CSP header in front of an unpatched HAX CMS instance
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; frame-ancestors 'self'; base-uri 'self'" always;