CVE-2026-46396: HAX CMS has a stored XSS via <iframe> that allows access to sensitive client-side data and account takeover

Synopsis

Stored cross-site scripting (XSS) in HAX CMS allows an authenticated attacker to inject a malicious iframe element containing a javascript: URI into a page. When any victim with sufficient browser access views that page, the injected script executes in the victim's browser session. Successful exploitation gives the attacker full read and write access to data visible to client-side scripts, including session tokens, and allows account takeover. No fix version has been published yet; HarborGuard is tracking the advisory for patch availability across affected image versions (haxcms-nodejs, video-player, and iframe-loader below 26.0.0).

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the HAX CMS service over the network to inject the malicious iframe payload into a stored page.

• AuthenticationRequired

  The attacker needs at least a low-privilege authenticated account to create or edit content and plant the malicious iframe.

• Victim interactionRequired

  A victim must navigate to or load the poisoned page in their browser for the injected javascript: URI to execute.

• Attack complexityDetail

  Exploitation is reliable and condition-free once the payload is stored; no race condition or special environmental state is required.

Blast Radius

• Reads session tokens, authentication cookies, and any sensitive data exposed to client-side scripts in the victim's browser context.
• Performs actions as the victim user, including modifying or deleting CMS content under the victim's account.
• Achieves full account takeover by exfiltrating credentials or forging authenticated requests on behalf of the victim.
• Propagates the stored payload to every subsequent visitor of the affected page, multiplying impact across all users of the instance.