CVE-2026-46496: HAX CMS: Stored XSS via '<video-player>' component allows arbitrary JavaScript execution and token theft

Synopsis

Stored cross-site scripting (XSS) in HAX CMS allows an attacker with a low-privilege account to inject malicious JavaScript into the `<video-player>` component by supplying a `javascript:` URI in the `source` attribute. The vulnerability is reachable over the network and triggers when any victim views the affected page, requiring no further attacker interaction after the payload is planted. Successful exploitation gives the attacker arbitrary JavaScript execution in the victim's browser, enabling theft of JWT tokens and other sensitive session data, as well as tampering with page content in the victim's session. No upstream fix version has been published yet; HarborGuard tracks this advisory and will make a patched-image rebuild available as soon as a fix is released.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must be able to reach the HAX CMS instance over the network to plant the stored payload, and victims must be able to load the affected page from their browser.

• AuthenticationRequired

  The attacker needs at least a low-privilege account on the HAX CMS instance to create or edit content containing the malicious `<video-player>` component.

• Victim interactionRequired

  A victim must view the page containing the injected payload for the JavaScript to execute in their browser session.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special race conditions, memory layout dependencies, or other environmental prerequisites.

Blast Radius

• Reads JWT tokens and session credentials stored in the victim's browser, enabling account takeover or authenticated API access as that user.
• Executes arbitrary JavaScript in the victim's browser context, allowing the attacker to exfiltrate any data visible on the page including customer records or configuration details.
• Modifies page content rendered in the victim's session, enabling phishing flows or redirection to attacker-controlled infrastructure.
• Propagates impact to downstream systems (SC:H, SI:H) if stolen tokens carry elevated privileges or cross-service authentication rights within the same trust boundary.