{"answers":{"affected":"2 open source packages ship an affected version, including @haxtheweb/haxcms-nodejs. It affects 1 product.","exploited":"There is no known exploitation of CVE-2026-22704 in the wild and no public exploit code.","fix":"Upgrade @haxtheweb/haxcms-nodejs to 25.0.0 or later.","what":"CVE-2026-22704 is a high-severity vulnerability in haxtheweb issues, published on 10 Jan 2026."},"fix_prompt":"Check this codebase for CVE-2026-22704 and fix it if it is affected.\n\nWhat it is: CVE-2026-22704 is a high-severity vulnerability in haxtheweb issues, published on 10 Jan 2026. \nExploitation: There is no known exploitation of CVE-2026-22704 in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- @haxtheweb/haxcms-nodejs (npm): affected from 11.0.6; fixed in 25.0.0\n- @haxtheweb/haxcms-nodejs (npm): affected from 11.0.6; fixed in 25.0.0\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-22704/ (Markdown: https://insights.sbomify.com/CVE-2026-22704/index.md)","id":"CVE-2026-22704","markdown":"https://insights.sbomify.com/CVE-2026-22704/index.md","name":"CVE-2026-22704","record":{"aliases":["GHSA-3fm2-xfq7-7778"],"analysis":null,"analysis_generated_by":null,"assigner":"GitHub_M","cpe":[{"product":"haxcms-nodejs","vendor":"psu"}],"cvss":{"score":8.1,"severity":"high","source":"cna","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H","version":"3.1"},"cwes":[{"id":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation"}],"description":"HAX CMS helps manage microsite universe with PHP or NodeJs backends. In versions 11.0.6 to before 25.0.0, HAX CMS is vulnerable to stored XSS, which could lead to account takeover. This issue has been patched in version 25.0.0.","ecosystems":["npm"],"exploits":{"exploitdb":1,"first_seen":"2026-04-29","github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[{"date":"2026-04-29","kind":"exploitdb","ref":"52526","stars":null,"title":"HAX CMS 24.x - Stored Cross-Site Scripting (XSS)"}],"tier":"poc_unverified"},"has_fix":true,"headline":"HAXcms Has Stored XSS Vulnerability that May Lead to Account Takeover","id":"CVE-2026-22704","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":"npm","product":null,"products":[],"type":null,"year":"2026"},"n_packages":2,"n_references":3,"next":{"headline":"RustCrypto: Signatures has timing side-channel in ML-DSA decomposition","id":"CVE-2026-22705"},"packages":[{"ecosystem":"npm","fixed":["25.0.0"],"introduced":["11.0.6"],"last_affected":[],"package":"@haxtheweb/haxcms-nodejs","purl":null,"source":"GHSA-3fm2-xfq7-7778"},{"ecosystem":"npm","fixed":["25.0.0"],"introduced":["11.0.6"],"last_affected":[],"package":"@haxtheweb/haxcms-nodejs","purl":"pkg:npm/%40haxtheweb/haxcms-nodejs","source":"GHSA-3fm2-xfq7-7778"}],"prev":{"headline":"Cosign verification accepts any valid Rekor entry under certain conditions","id":"CVE-2026-22703"},"products":["issues"],"published":"2026-01-10","related":[{"cvss_score":9.3,"headline":"HAXcms's Insecure Default Configuration Leads to Unauthenticated Access","id":"CVE-2025-54127","kev_date_added":null,"published":"2025-07-21"},{"cvss_score":8.6,"headline":"HaxCMS-PHP Command Injection Vulnerability","id":"CVE-2025-49141","kev_date_added":null,"published":"2025-06-09"},{"cvss_score":8.5,"headline":"Hax CMS Stored Cross-Site Scripting vulnerability","id":"CVE-2025-49137","kev_date_added":null,"published":"2025-06-09"},{"cvss_score":8.3,"headline":"HAX CMS Backend Lacks Comprehensive Authorization Checks","id":"CVE-2025-54378","kev_date_added":null,"published":"2025-07-26"},{"cvss_score":7.3,"headline":"NodeJS version of the HAX CMS application is distributed with Default Secrets","id":"CVE-2025-54137","kev_date_added":null,"published":"2025-07-22"},{"cvss_score":7.2,"headline":"HAX CMS NodeJs's Disabled Content Security Policy Enables Cross-Site Scripting","id":"CVE-2025-54128","kev_date_added":null,"published":"2025-07-21"}],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"},{"class":"attribution","licence":"US public information, NVD API terms","name":"NVD"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"},{"class":"attribution","licence":"GPL-2.0-or-later","name":"Exploit-DB"}],"ssvc":{"automatable":"no","exploitation":"none","technical_impact":"total"},"state":"PUBLISHED","updated":"2026-01-13","vendors":["haxtheweb"]},"summary":null,"url":"https://insights.sbomify.com/CVE-2026-22704/"}