CVE-2026-48527: HAX CMS Stored XSS Vulnerability

CVE-2026-48527 Overview

CVE-2026-48527 is a stored cross-site scripting (XSS) vulnerability in HAX CMS, a content management system that manages microsite environments using PHP or Node.js backends. The flaw exists in the /system/api/saveNode endpoint and affects all versions up to and including 26.0.0. An authenticated user with page-edit permissions can bypass the HTML sanitizer by injecting an event handler attribute without whitespace before the attribute name. The maintainers released @haxtheweb/haxcms-nodejs 26.0.1 and haxcms-php 26.0.2 to address the issue. The vulnerability is classified under CWE-79.

Critical Impact

Authenticated attackers can store malicious JavaScript that executes in victim browsers, enabling session theft, account takeover, and lateral movement within the CMS.

Affected Products

• HAX CMS (@haxtheweb/haxcms-nodejs) versions ≤ 26.0.0
• HAX CMS (haxcms-php) versions ≤ 26.0.0
• Any HAX CMS deployment exposing the /system/api/saveNode endpoint

Discovery Timeline

• 2026-05-29 - CVE-2026-48527 published to NVD
• 2026-05-29 - Last updated in NVD database

Technical Details for CVE-2026-48527

Vulnerability Analysis

The vulnerability resides in the HTML sanitization logic used by the /system/api/saveNode endpoint. HAX CMS accepts HTML content from authenticated editors and attempts to strip dangerous constructs such as inline event handlers before persisting node data. The sanitizer parses attributes assuming standard whitespace separation between the tag name and subsequent attributes.

Attackers can submit a payload where an event handler attribute, such as onerror or onload, is appended directly to a preceding token without an intervening whitespace character. The sanitizer fails to recognize the attribute as an event handler and leaves it intact. When other clients render the stored page, the browser parses the malformed markup leniently and executes the injected handler.

The attack requires only low privileges (page-edit access) and user interaction from a victim who views the affected page. Because the payload persists in saved content, every visitor to the compromised microsite is exposed.

Root Cause

The sanitizer relies on a tokenization approach that does not normalize input before pattern matching. Attribute names parsed without leading whitespace bypass the deny-list checks that filter event handlers. This is a classic input-validation flaw where parser differential behavior between the sanitizer and the browser enables the bypass.

Attack Vector

An authenticated editor sends a crafted POST request to /system/api/saveNode containing HTML with a malformed attribute boundary. The malicious markup is stored in the node content. When an administrator or other user opens the page, the browser executes the injected script in the application origin. The full technical write-up is available in the GitHub Security Advisory GHSA-g2g8-95qg-v35h.

Detection Methods for CVE-2026-48527

Indicators of Compromise

• POST requests to /system/api/saveNode containing HTML attribute patterns where event handler names (onerror, onload, onclick, onmouseover) appear without preceding whitespace.
• Stored node content in HAX CMS data stores containing inline JavaScript handlers or javascript: URIs.
• Unexpected outbound requests from user browsers to attacker-controlled domains originating from CMS-rendered pages.

Detection Strategies

• Inspect web server access logs for POST traffic to /system/api/saveNode from accounts that do not normally author content.
• Scan stored node JSON or database records for HTML patterns matching [^\s]on[a-z]+\s*= to identify potential bypass payloads.
• Review browser Content Security Policy (CSP) violation reports for inline script executions within CMS-served pages.

Monitoring Recommendations

• Enable verbose audit logging on editor accounts and alert on bulk or anomalous saveNode activity.
• Monitor for new or modified editor accounts, particularly those created shortly before content modification spikes.
• Track outbound connections from CMS rendering processes and end-user sessions for known XSS exfiltration patterns.

How to Mitigate CVE-2026-48527

Immediate Actions Required

• Upgrade @haxtheweb/haxcms-nodejs to version 26.0.1 or haxcms-php to version 26.0.2 without delay.
• Audit existing node content for stored payloads using attribute boundary patterns described above and remove offending entries.
• Review and reduce the set of accounts with page-edit permissions to the minimum operationally required.

Patch Information

The HAX CMS maintainers fixed the sanitizer bypass in @haxtheweb/haxcms-nodejs 26.0.1 and haxcms-php 26.0.2. Patch details and the full advisory are published in GHSA-g2g8-95qg-v35h.

Workarounds

• Restrict access to the /system/api/saveNode endpoint via a reverse proxy or web application firewall (WAF) rule that blocks payloads containing event handler attributes without preceding whitespace.
• Enforce a strict Content Security Policy that disallows inline script execution (script-src 'self') on all CMS-served pages.
• Temporarily revoke edit permissions from non-essential accounts until patches are deployed.

# Upgrade the Node.js backend
npm install @haxtheweb/haxcms-nodejs@26.0.1

# Upgrade the PHP backend via Composer
composer require haxtheweb/haxcms-php:26.0.2

# Verify installed versions
npm list @haxtheweb/haxcms-nodejs
composer show haxtheweb/haxcms-php