Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

npm package

@haxtheweb/iframe-loader

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 8.6npmAmendedPublished

    Stored XSS via in HAX CMS allows access to sensitive client-side data and account takeover

    CVE-2026-46396 · GHSA-jh3h-rpxg-fr36

    Affected
    • npm @haxtheweb/iframe-loader <= 25.0.0
    Fixed in
    26.0.0· Vendor fix available
    Issue
    A stored cross-site scripting (XSS) vulnerability exists in HAX CMS due to improper sanitization of <iframe elements. The application allows javascript: URIs in the src attribute, which are executed when a malicious page is viewed. This enables attackers to execute arbitrary JavaScript in the context of the victim’s browser and access sensitive data exposed to client-side scripts. Details Successful exploitation allows access to any data available in the browser context, including: - Authentication tokens (e.g., JWT) - Session cookies (if not protected with HttpOnly) - Application configuration (e.g., window.appSettings) - User-specific data accessible via APIs This significantly increases the impact beyond simple script execution. PoC Steps to reproduce: 1. Log in to HAX CMS as any authenticated user. 2. Create a new page or edit an existing page. 3. Open the HTML source editor (<). 4. Insert the following payload: <img width="2446" height="1319" alt="image"…

    Recommended action: Upgrade to 26.0.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:osv.dev (1)github.com (2)Source checked Evidence →