CVE-2025-54128 HAX CMS NodeJs's Disabled Content Security Policy Enables Cross-Site Scripting
Attackers can execute arbitrary scripts due to disabled Content Security Policy in HAX CMS Node.js backend, requiring an upgrade to secure production environments.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2025-54128?
CVE-2025-54128 is a high-severity cross-site scripting vulnerability in haxtheweb issues, published on 21 Jul 2025. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
HAX CMS NodeJs allows users to manage their microsite universe with a NodeJs backend. In versions 11.0.7 and below, the NodeJS version of HAX CMS has a disabled Content Security Policy (CSP). This configuration is insecure for a production application because it does not protect against cross-site-scripting attacks. The contentSecurityPolicy value is explicitly disabled in the application's Helmet configuration in app.js. This is fixed in version 11.0.8.
Weakness: CWE-79
Which versions are affected by CVE-2025-54128?
2 open source packages ship an affected version, including @haxtheweb/haxcms-nodejs. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
@haxtheweb/haxcms-nodejs npm | All versions | 11.0.8 |
@haxtheweb/haxcms-nodejs npm | All versions | 11.0.8 |
Products include Psu Haxcms-Nodejs.
How do I fix CVE-2025-54128?
Upgrade @haxtheweb/haxcms-nodejs to 11.0.8 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2025-54128 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-54128 exists.
Other vulnerabilities in haxtheweb issues
- CVE-2025-54127 HAXcms's Insecure Default Configuration Leads to Unauthenticated Access
- CVE-2025-49141 HaxCMS-PHP Command Injection Vulnerability
- CVE-2025-49137 Hax CMS Stored Cross-Site Scripting vulnerability
- CVE-2025-54378 HAX CMS Backend Lacks Comprehensive Authorization Checks
- CVE-2026-22704 HAXcms Has Stored XSS Vulnerability that May Lead to Account Takeover
Sources
Also known as GHSA-59g8-h59f-8hjp.