GitHub Advisoryadvisory · npm

GHSA-59g8-h59f-8hjp NodeJS version of HAX CMS Has Disabled Content Security Policy That Enables Cross-Site Scripting

HIGH Published 2025-07-21 Modified 2025-07-21 Official page ↗
Aliases
CVE-2025-54128
Ecosystem
npm
Packages
@haxtheweb/haxcms-nodejs
Severity
High
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:H/SC:L/SI:L/SA:N
Weaknesses
CWE-79
Reviewed
2025-07-21

Affected packages

• npm @haxtheweb/haxcms-nodejs: < 11.0.8 → fixed in 11.0.8

Description

Summary The NodeJS version of HAX CMS has a disabled Content Security Policy (CSP). This configuration is insecure for a production application because it does not protect against cross-site-scripting attacks. Details The `contentSecurityPolicy` value is explicitly disabled in the application's Helmet configuration in `app.js`. Affected Resources • app.js:52 PoC To reproduce this vulnerability, install HAX CMS NodeJS. The application will load without a CSP configured. Impact In conjunction with an XSS vulnerability, an attacker could execute arbitrary scripts and exfiltrate data, including session tokens and sensitive local data. Additional Information • OWASP: Content Security Policy

Related

Alias · CVE (1)

  • CVE-2025-54128 HAX CMS NodeJs allows users to manage their microsite universe with a NodeJs backend. vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References