npm/@haxtheweb/haxcms-nodejs CVE-2026-46496: critical 9.3, EPSS 0.23%

HAX CMS: Stored XSS via '<video-player>' component allows arbitrary JavaScript execution and token theft

Action: Upgrade @haxtheweb/haxcms-nodejs to 26.0.0 or later.

npm i @haxtheweb/haxcms-nodejs@26.0.0

Affected

Fixed versions

Sources

• osv: GHSA-2m6p-hm3w-6jm3
• nvd: CVE-2026-46496
• https://github.com/haxtheweb/issues/security/advisories/GHSA-2m6p-hm3w-6jm3
• https://github.com/haxtheweb/issues

CVE-2026-46496 · published 2026-05-19T14:44:34Z · modified 2026-09-10T03:51:04.260595233Z · JSON