haxtheweb/haxcms-nodejs · Security
NodeJS version of HAX CMS Has Disabled Content Security Policy That Enables Cross-Site Scripting
- GHSA ID
- GHSA-59g8-h59f-8hjp
- CVE ID
- CVE-2025-54128
- Severity
- high
- Published
- Updated
- CVSS v4
- 7.2 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:H/SC:L/SI:L/SA:N
Description
Summary
The NodeJS version of HAX CMS has a disabled Content Security Policy (CSP). This configuration is insecure for a production application because it does not protect against cross-site-scripting attacks.
Details
The contentSecurityPolicy value is explicitly disabled in the application's Helmet configuration in app.js.
Affected Resources
PoC
To reproduce this vulnerability, install HAX CMS NodeJS. The application will load without a CSP configured.
Impact
In conjunction with an XSS vulnerability, an attacker could execute arbitrary scripts and exfiltrate data, including session tokens and sensitive local data.
Additional Information
CWEs
- CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')