| Package | Affected versions | Patched versions |
|---|---|---|
| haxcms-nodejs | < 11.0.8 | 11.0.8 |
| @haxtheweb/haxcms-nodejs | < 11.0.8 | 11.0.8 |
The NodeJS version of HAX CMS has a disabled Content Security Policy (CSP). This configuration is insecure for a production application because it does not protect against cross-site-scripting attacks.
The contentSecurityPolicy value is explicitly disabled in the application's Helmet configuration in app.js.
To reproduce this vulnerability, install HAX CMS NodeJS. The application will load without a CSP configured.
In conjunction with an XSS vulnerability, an attacker could execute arbitrary scripts and exfiltrate data, including session tokens and sensitive local data.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free