cve.bz

CVE-2026-48527

8.7 highEPSS 0.2%

High (8.7). EPSS 0.2% chance of exploitation in the next 30 days. Fixed in @haxtheweb/haxcms-nodejs 26.0.1.

HAX CMS helps manage microsite universe with PHP or NodeJs backends. Versions up to and including 26.0.0 are affected by a stored cross-site scripting (XSS) vulnerability in the `/system/api/saveNode` endpoint. An authenticated user with a permission to edit pages can bypass the HTML sanitizer by injecting an event handler attribute without whitespace before the attribute name. @haxtheweb/haxcms-nodejs 26.0.1 and haxcms-php 26.0.2 patch the issue.

Severity

CVSS 3.1

8.7 high
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
EPSS
0.2% chance of exploitation in the next 30 days; higher than 13% of CVEs (scores of 2026-10-31)
CWE
CWE-79
Published
Modified
Record from
the NVD, synced

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-g2g8-95qg-v35hnpm@haxtheweb/haxcms-nodejs<26.0.126.0.1

References

Check your stackJSON