dbcve.org
Cross-site Scripting (XSS)Weakness · CWE-79

CVE-2026-46396

CRITICAL · 9.3 CVSS v4.0 Published 2026-06-05
Mitigation only
No fix yet — a mitigation exists. There is no fixed release. A documented workaround reduces exposure in the meantime.
See remediation →
97/100
Remediation priority · Urgent
Remotely reachable

Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.

NVD · unedited
HAX CMS helps manage microsite universe with PHP or NodeJs backends. A stored cross-site scripting (XSS) vulnerability exists in versions prior to 26.0.0 due to improper sanitization of `<iframe>` elements. The application allows `javascript:` URIs in the `src` attribute, which are executed when a malicious page is viewed. This enables attackers to execute arbitrary JavaScript in the context of the victim’s browser and access sensitive data exposed to client-side scripts. Version 26.0.0 fixes the issue.

Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.

dbcve analysis · high confidence

HAX CMS fails to properly sanitize iframe elements, allowing javascript: URIs in the src attribute to be stored and executed. When authenticated users view maliciously crafted content, the javascript: protocol executes arbitrary code in their browser context, enabling session hijacking and sensitive data exfiltration.

MitigationUpgrade to HAX CMS version 26.0.0 or later which implements proper iframe sanitization to block javascript: and other dangerous URI schemes.

Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.

CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.

From the vector
Attack vector
Network
Complexity
Low
Privileges
Low
Authentication
X
User interaction
P
Scope
X

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.

dbcve checks

Work through these to decide whether this CVE applies to you.

  1. Check the installed HAX CMS version
    Locate the version file (typically version.json, package.json, or in the admin dashboard under Site Settings > About). Compare the version number to the fixed version 26.0.0.
    Affected if The installed version is lower than 26.0.0 (e.g., 25.x, 24.x, etc.)
  2. Identify content authoring capabilities
    Determine if the CMS allows authenticated users to create or edit content pages, blog posts, or other content types that support embedding HTML elements.
    Affected if Authenticated users (editors, authors, or lower-privileged users) have the ability to insert or modify HTML/iframe elements in content.
  3. Search stored content for iframe elements
    Query the CMS database or inspect content files for occurrences of the <iframe> HTML tag in the content storage (typically a database table like 'nodes', 'content', or flat files in a /content/ directory).
    Affected if Iframe elements exist in stored content within the CMS.
  4. Inspect iframe src attributes for dangerous URI schemes
    Examine any stored iframe elements and check the src attribute values. Look for URIs beginning with 'javascript:' or other potentially dangerous schemes (e.g., 'javascript:alert()', 'javascript:document.cookie').
    Affected if Any iframe element has a src attribute containing a javascript: URI scheme.
  5. Review recent content edits for suspicious iframes
    Check content revision history, audit logs, or recent activity logs for iframe additions, particularly from users who should not normally be embedding iframes.
    Affected if Recent content contains iframe elements with non-standard or suspicious src values.

You are affected if your HAX CMS installation is version 25.x or lower AND allows authenticated users to create or edit content containing iframe elements, particularly if javascript: URIs are found in stored iframe src attributes.

Generated from the published advisory. Verify against your own configuration.

Check your environment

Paste your version and any relevant configuration and it will be compared against the affected criteria above. Do not include secrets or credentials.

AI-assisted, checked against the advisory. Informational, not a guarantee.

Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.

dbcve · scoped
Mitigation available No clean upgrade yet — mitigate in the meantime
Mitigation

Upgrade to HAX CMS version 26.0.0 or later which implements proper iframe sanitization to block javascript: and other dangerous URI schemes.

Recommended fix Moderate confidence

26.0.0

  1. 1. Back up your current HAX CMS installation and database before proceeding with any upgrade.
  2. 2. Identify your current HAX CMS version by checking the version file or admin dashboard.
  3. 3. Download HAX CMS version 26.0.0 from the official GitHub repository or release channel.
  4. 4. Follow the standard upgrade procedure: replace core files while preserving your configuration and content directories.
  5. 5. Clear any application caches after the upgrade.
  6. 6. Verify the installation by logging into the admin panel.
  7. 7. Test that iframe elements with javascript: URIs are now properly sanitized and blocked.

Generated from the published advisory — verify against the referenced sources before acting.

Have this fixed Scoped from the published advisory
  • Consultation3.0 h
  • Implementation2.0 h
  • Testing3.0 h
  • Review / QA2.0 h
10.0 hours of engineering $1,770
Get help mitigating

An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $2,832.

Scan for this in your stack

Free · runs locally
dbcve dependency scanner

Check whether your project pulls in CVE-2026-46396 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.

Get it on GitHub Scan in the browser

References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.

Primary sources

Practitioner notes

Contributed

Peer-ranked notes from engineers who’ve handled CVE-2026-46396 in production — separate from our analysis above.

No notes yet

Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.

What this is

A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.

What belongs here
  • Verified mitigations, workarounds, and config changes
  • Version or environment caveats, and links to real fixes
  • No weaponised exploit code, or anything meant to cause harm
  • No spam, self-promotion, credentials, or personal data