@haxtheweb/haxcms-nodejs Iframe Phishing vulnerability
Summary
In the HAX site editor, users can create a website block to load another site in an iframe. The application allows users to supply a target URL in the website block. When the HAX site is visited, the client's browser will query the supplied URL.
Affected Resources
- Operations.php:868
https://<site>/<user>/system/api/saveNode
PoC
- Set the URL in an iframe pointing to an attacker-controlled server running Responder
- Once another user visits the site, they are prompted to sign in.
- If a user inputs credentials, the username and password hash are outputted in Responder.
Impact
An authenticated attacker can create a HAX site with a website block pointing at an attacker-controlled server running Responder or a similar tool. The attacker can then conduct a phishing attack by convincing another user to visit their malicious HAX site to harvest credentials.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| npm package | @haxtheweb/haxcms-nodejs | < 11.0.0 | 11.0.0 |
References
- CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N- Weakness (CWE)
CWE-1021- Platform
- npm
- Package
@haxtheweb/haxcms-nodejs- Disclosed
- 09.06.2025
- Updated
- 11.10.2026 10:22
Sources and licenses
OSV / GitHub Advisory Database - GHSA-v3ph-2q5q-cg88 - CC BY 4.0
Vulnerability history: @haxtheweb/haxcms-nodejs
All published vulnerabilities of this package (npm package), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 16
- First → latest
- 06.2025 05.2026
- Without a fix
- 0
- Exploited in attacks
- 0
Severity breakdown
- Critical 2
- High 10
- Medium 4
Disclosures per year
- 2025: 8
- 2026: 8
-
@haxtheweb/haxcms-nodejs Iframe Phishing vulnerability this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.