CVE-2025-54128: NodeJS version of HAX CMS Has Disabled Content Security Policy That Enables Cross-Site Scripting

July 21, 2025

The NodeJS version of HAX CMS has a disabled Content Security Policy (CSP). This configuration is insecure for a production application because it does not protect against cross-site-scripting attacks.

References

github.com/advisories/GHSA-59g8-h59f-8hjp
github.com/haxtheweb/haxcms-nodejs
github.com/haxtheweb/haxcms-nodejs/commit/ddb9351c6d6418008d4084a5b17fd6d611bc4e30
github.com/haxtheweb/issues/security/advisories/GHSA-59g8-h59f-8hjp
nvd.nist.gov/vuln/detail/CVE-2025-54128

Code Behaviors & Features

Detect and mitigate CVE-2025-54128 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →