npm/@haxtheweb/haxcms-nodejs CVE-2026-46396: critical 9.3, EPSS 0.23%

Stored XSS via <iframe> in HAX CMS allows access to sensitive client-side data and account takeover

Action: Upgrade @haxtheweb/haxcms-nodejs to 26.0.0 or later.

npm i @haxtheweb/haxcms-nodejs@26.0.0

Affected

Fixed versions

Sources

• osv: GHSA-jh3h-rpxg-fr36
• nvd: CVE-2026-46396
• https://github.com/haxtheweb/issues/security/advisories/GHSA-jh3h-rpxg-fr36
• https://github.com/haxtheweb/issues

CVE-2026-46396 · published 2026-05-19T14:46:47Z · modified 2026-09-10T03:51:06.237354969Z · JSON