CVE-2026-46396: HAX CMS Stored XSS Vulnerability

CVE-2026-46396 Overview

CVE-2026-46396 is a stored cross-site scripting (XSS) vulnerability in HAX CMS, an open-source platform that manages microsite ecosystems with PHP or Node.js backends. The flaw exists in versions prior to 26.0.0 and stems from improper sanitization of <iframe> elements. The application accepts javascript: URIs in the src attribute, which execute when a victim loads the malicious page. Attackers exploit this weakness to run arbitrary JavaScript in the victim's browser and access data exposed to client-side scripts. The HAX CMS maintainers fixed the issue in version 26.0.0. The vulnerability is tracked under CWE-79.

Critical Impact

Authenticated attackers can store malicious javascript: URIs inside iframe elements to hijack sessions, exfiltrate sensitive client-side data, and pivot against other users of the CMS.

Affected Products

• HAX CMS (PHP backend) versions prior to 26.0.0
• HAX CMS (Node.js backend) versions prior to 26.0.0
• Microsites and content rendered through vulnerable HAX CMS instances

Discovery Timeline

• 2026-06-05 - CVE-2026-46396 published to NVD
• 2026-06-09 - Last updated in NVD database

Technical Details for CVE-2026-46396

Vulnerability Analysis

HAX CMS renders user-supplied content that can include <iframe> elements. The sanitizer enforced by versions prior to 26.0.0 strips common script vectors but permits the src attribute to carry javascript: URIs. When the browser loads the iframe, it evaluates the URI as inline JavaScript inside the parent document's origin. This converts a content authoring feature into a stored XSS primitive.

The attacker payload persists in the CMS data store and executes for every viewer of the affected page. Stored XSS in a CMS context typically allows session theft, credential capture through fake login overlays, forced administrative actions through same-origin requests, and silent modification of additional microsite content.

Root Cause

The root cause is incomplete output sanitization of HTML attribute values. The iframe allowlist focused on tag removal rather than URI scheme validation. Without a strict allowlist that rejects any scheme outside https: and http:, javascript: URIs survive sanitization and reach the DOM as executable code.

Attack Vector

Exploitation requires low privileges sufficient to author or edit content within HAX CMS. The attacker injects an <iframe> element whose src attribute uses a javascript: URI carrying the payload. When another user, often a higher-privileged editor or administrator, opens the page, the script executes in their browser context. User interaction in the form of visiting the page is required. No verified public exploit code is currently available.

For technical specifics, consult the GitHub Security Advisory GHSA-jh3h-rpxg-fr36.

Detection Methods for CVE-2026-46396

Indicators of Compromise

• Stored content containing <iframe> tags whose src attribute begins with javascript:, data:, or vbscript: schemes.
• Unexpected outbound requests from authenticated browser sessions to attacker-controlled domains shortly after loading CMS pages.
• Newly created administrative accounts or content edits that coincide with privileged users visiting suspicious microsite pages.

Detection Strategies

• Scan the HAX CMS content database for the regular expression <iframe[^>]+src\s*=\s*['\"]\s*javascript: across all stored fields.
• Review web server access logs for requests to pages that contain iframe payloads, correlating with referrer chains involving editor sessions.
• Enable a strict Content Security Policy in report-only mode and monitor violation reports for blocked inline script and javascript URI execution attempts.

Monitoring Recommendations

• Forward CMS audit logs and browser CSP violation reports to a centralized analytics platform for correlation with authentication events.
• Alert on edits performed by accounts with content authoring privileges that introduce iframe or script-bearing markup.
• Track session anomalies such as token reuse from new IP addresses immediately after privileged users access pages containing untrusted content.

How to Mitigate CVE-2026-46396

Immediate Actions Required

• Upgrade all HAX CMS instances to version 26.0.0 or later without delay.
• Audit existing content for iframe elements using javascript:, data:, or other non-HTTP URI schemes and remove them.
• Rotate session tokens and review administrator account activity for unauthorized changes introduced before the upgrade.

Patch Information

The HAX CMS maintainers released version 26.0.0, which sanitizes <iframe> elements and rejects javascript: URIs in the src attribute. The fix is documented in the GitHub Security Advisory GHSA-jh3h-rpxg-fr36. Apply the upgrade through the standard package update workflow for the PHP or Node.js deployment in use.

Workarounds

• Enforce a Content Security Policy that disallows inline script execution and restricts iframe sources to a trusted allowlist.
• Restrict content authoring privileges to a minimal set of trusted accounts until the upgrade is deployed.
• Place HAX CMS behind a web application firewall rule that blocks request bodies containing javascript: URIs inside iframe attributes.

# Example CSP header to block javascript: URIs and inline script execution
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; frame-src https:; object-src 'none'; base-uri 'self'";