Stored XSS in HAX CMS Page Editor via Sanitizer Bypass

HAX CMS helps manage microsite universe with PHP or NodeJs backends. Versions up to and including 26.0.0 are affected by a stored cross-site scripting (XSS) vulnerability in the `/system/api/saveNode` endpoint. An authenticated user with a permission to edit pages can bypass the HTML sanitizer by injecting an event handler attribute without whitespace before the attribute name. @haxtheweb/haxcms-nodejs 26.0.1 and haxcms-php 26.0.2 patch the issue.

Casky was already ahead

This CVE exploits attack patterns that Casky's 301matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

HAX CMS, a PHP and Node.js-based platform for managing microsites, contains a stored cross-site scripting (XSS) vulnerability in the `/system/api/saveNode` endpoint affecting versions through 26.0.0. Authenticated users with page editing permissions can inject malicious event handler attributes that bypass the HTML sanitizer by omitting whitespace before attribute names—a classic evasion technique. Once stored, this payload executes in the browsers of other users viewing the compromised page, enabling session hijacking, credential theft, and lateral movement within the CMS. Organizations running HAX CMS versions 26.0.0 or earlier should immediately upgrade to 26.0.1 (Node.js) or 26.0.2 (PHP) to remediate this high-severity flaw (CVSS 8.7).

Casky's 301 mapped security skills detect this attack pattern across both MITRE ATT&CK techniques—TA0001 (Initial Access) via credential compromise of existing users and TA0043 (Reconnaissance) through stored payload delivery analytics. When practitioners query Casky's Claude AI-powered engine, they receive findings aligned with CWE-79 input validation weaknesses, identifying suspicious sanitizer-bypass patterns in API request logs: specifically, event handlers lacking expected whitespace delimiters, anomalous HTML entity encoding variations, and payloads stored in page node objects. The platform flags authentication logs showing lower-privileged accounts accessing `/system/api/saveNode`, highlights stored content containing executable JavaScript without proper encoding markers, and correlates browser-based session activity with stored XSS injection timestamps—enabling security teams to scope impact and rapidly isolate compromised pages before widespread exploitation.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

301 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-48527.

analyzing-apt-group-with-mitre-navigator

threat intelligence · low

Run

analyzing-campaign-attribution-evidence

threat intelligence · low

Run

analyzing-certificate-transparency-for-phishing

threat intelligence · low

Run

MITRE ATT&CK Techniques

TA0001 TA0043

Investigate the attack patterns behind CVE-2026-48527

Casky has 301 skills that investigate the attack patterns behind CVE-2026-48527. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn