CVE-2026-46496: HAX CMS: Stored XSS via '<video-player>' component allows arbitrary JavaScript execution and token theft

May 19, 2026

A stored cross-site scripting (XSS) vulnerability exists in HAX CMS due to improper sanitization of the <video-player> component.

The component allows javascript: URIs in the source attribute, which are executed when the page is viewed. This enables attackers to execute arbitrary JavaScript in the context of the victim’s browser and access sensitive data such as JWT tokens and more.

References

github.com/advisories/GHSA-2m6p-hm3w-6jm3
github.com/haxtheweb/issues/security/advisories/GHSA-2m6p-hm3w-6jm3
nvd.nist.gov/vuln/detail/CVE-2026-46496

Code Behaviors & Features

Detect and mitigate CVE-2026-46496 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →