What is the CVSS score of EUVD-2026-33286?

EUVD-2026-33286 has a CVSS 3.1 base score of 8.7 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of HAX CMS are affected by EUVD-2026-33286?

HAX CMS (haxcms-nodejs and haxcms-php through version 26.0.0) allows authenticated page editors to inject persistent malicious JavaScript that executes in other users' browsers, potentially…. A patch is available.

How to fix or mitigate EUVD-2026-33286?

Within 24 hours: identify all HAX CMS deployments and versions; restrict page editor role assignments to essential personnel and audit access. Within 7 days: contact HAX vendor for patch timeline; implement WAF rules blocking XSS event handler patterns in requests to /system/api/saveNode; deploy Content Security Policy headers. Within 30 days: upgrade to patched version when available or initiate CMS migration if vendor provides no patch timeline.

HAX CMS EUVD-2026-33286

| CVE-2026-48527 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-05-29 GitHub_M

GHSA-g2g8-95qg-v35h

XSS PHP

8.7

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.7 HIGH

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Patch available

May 29, 2026 - 14:01 EUVD

Analysis Generated

May 29, 2026 - 13:20 vuln.today

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

3 npm packages depend on @haxtheweb/haxcms-nodejs (1 direct, 2 indirect)

Ecosystem-wide dependent count for version 26.0.1.

DescriptionGitHub Advisory

HAX CMS helps manage microsite universe with PHP or NodeJs backends. Versions up to and including 26.0.0 are affected by a stored cross-site scripting (XSS) vulnerability in the /system/api/saveNode endpoint. An authenticated user with a permission to edit pages can bypass the HTML sanitizer by injecting an event handler attribute without whitespace before the attribute name. @haxtheweb/haxcms-nodejs 26.0.1 and haxcms-php 26.0.2 patch the issue.

AnalysisAI

Stored cross-site scripting in HAX CMS (haxcms-nodejs and haxcms-php) through version 26.0.0 allows authenticated page editors to bypass the HTML sanitizer via the /system/api/saveNode endpoint by omitting whitespace before an event handler attribute name. Successful exploitation executes attacker-controlled JavaScript in the browsers of other users viewing the affected microsite, with scope change enabling impact beyond the attacker's own privilege level. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.

Technical ContextAI

HAX CMS is a microsite management platform distributed as two backends, @haxtheweb/haxcms-nodejs and haxcms-php, both identified in the CPE data (cpe:2.3:a:haxtheweb:haxcms-nodejs and cpe:2.3:a:haxtheweb:haxcms-php). The root cause maps to CWE-79 (Improper Neutralization of Input During Web Page Generation) - specifically a sanitizer parsing flaw where the HTML filter expects whitespace as an attribute delimiter and fails to recognize event handler attributes (e.g. onerror, onclick) packed against the preceding token. Because the malicious markup is persisted server-side via the saveNode API and later rendered to other viewers of the page, the flaw is a stored XSS rather than reflected, increasing reach and persistence within affected microsites.

RemediationAI

Vendor-released patches are available: upgrade @haxtheweb/haxcms-nodejs to 26.0.1 or haxcms-php to 26.0.2 per the GitHub Security Advisory at https://github.com/haxtheweb/issues/security/advisories/GHSA-g2g8-95qg-v35h. Until upgrades are deployed, compensating controls include restricting which accounts hold page-edit permissions to fully trusted users, auditing recently saved nodes via the /system/api/saveNode endpoint for event-handler attributes without preceding whitespace (e.g. patterns like "\"onerror=" or "/onload="), and fronting the application with a strict Content Security Policy that disallows inline event handlers and inline script - note that a strict CSP may break legitimate HAX components that rely on inline behavior and should be tested in staging before enforcement.