Description
A stored cross-site scripting (XSS) vulnerability exists in HAX CMS due to improper sanitization of the <video-player> component.
The component allows javascript: URIs in the source attribute, which are executed when the page is viewed.
Recommendation
Update the @haxtheweb/video-player package to the latest compatible version. Followings are version details:
- Affected version(s): <= 25.0.0
- Patched version(s): 26.0.0
References
Could your website be exposed too?
SmartScanner can check your website for HAX CMS: Stored XSS via '<video-player>' component allows arbitrary JavaScript execution and token theft and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Stored XSS via <iframe> in HAX CMS allows access to sensitive client-side data and account takeover - @haxtheweb/video-player - CVE-2026-46396
- Stored XSS via <iframe> in HAX CMS allows access to sensitive client-side data and account takeover - CVE-2026-46396
- @diplodoc/search-extension allows stored XSS via Markdown file title - CVE-2026-40201
- Electerm has an unvalidated shell.openExternal that allows arbitrary protocol execution via terminal link click - CVE-2026-43941
You might also like:
See something that needs correcting? Let us knowUpdated June 09, 2026