CVE-2026-22704

npm/@haxtheweb/haxcms-nodejs CVE-2026-22704: high 8

HAXcms Has Stored XSS Vulnerability that May Lead to Account Takeover

Action: Upgrade @haxtheweb/haxcms-nodejs to 25.0.0 or later.

npm i @haxtheweb/haxcms-nodejs@25.0.0

Affected

Fixed versions

Sources

• osv: GHSA-3fm2-xfq7-7778
• https://github.com/haxtheweb/issues/security/advisories/GHSA-3fm2-xfq7-7778
• https://nvd.nist.gov/vuln/detail/CVE-2026-22704
• https://github.com/haxtheweb/haxcms-nodejs/commit/317a8ae29f88be389f7cfeffaef416957122d97e
• https://github.com/haxtheweb/haxcms-nodejs/releases/tag/v25.0.0
• https://github.com/haxtheweb/issues

CVE-2026-22704 · published 2026-01-13T15:07:57Z · modified 2026-02-03T03:01:35.507766Z · JSON