HaxCMS has a stored Cross-Site Scripting (XSS) bypass in its saveNode endpoint
Date: 2026-05
Affected: npm/@haxtheweb/haxcms-nodejs
Attack vector: xss
Category: vulnerability-disclosure
Severity: High
CVE: CVE-2026-48527
CWE: CWE-79
CVSS: 8.7 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N)

## Summary HaxCMS is affected by a stored cross-site scripting (XSS) vulnerability in the `/system/api/saveNode` endpoint. An authenticated user with a permission to edit pages can bypass the HTML sanitizer by injecting an event handler attribute without whitespace before the attribute name. For example, the sanitizer misses: ```html <a href="#"onclick="alert('kn1ph')">click me</a> ``` The important bypass is: ```html href="#"onclick= ``` The payload is stored in the generated page files and executes when a user clicks the injected link. ## Details The issue is caused by regex-based HTML sanitization that expects whitespace before event handler attributes. Because the sanitizer expects a pattern like: ```html href="#" onclick="..." ``` It fails to remove an event handler when it is written without whitespace: ```html href="#"onclick="..." ``` Browsers still parse `onclick` as a valid event handler attribute, so the JavaScript executes when the element is clicked. Affected endpoint: ```text POST /system/api/saveNode?site_token=[VALID_SITE_TOKEN] ``` Affected parameter: ```text node.body ``` ## PoC 1. Log in to HaxCMS and edit any existing page. 2. Capture the page save request in Burp Suite: ```text POST /system/api/saveNode?site_token=[VALID_SITE_TOKEN] ``` 3. In the JSON request body, modify only the `node.body` value. Change: ```json "body":"...existing page content...\n" ``` To: ```json "body":"...existing page content...\n<a href=\"#\"onclick=\"alert(


Mitigations:

Architectural layers (MAESTRO):