CVE-2025-49139: @haxtheweb/haxcms-nodejs Iframe Phishing vulnerability

June 9, 2025

In the HAX site editor, users can create a website block to load another site in an iframe. The application allows users to supply a target URL in the website block. When the HAX site is visited, the client’s browser will query the supplied URL.

References

github.com/advisories/GHSA-v3ph-2q5q-cg88
github.com/haxtheweb/haxcms-nodejs/commit/5368eb9b278ca47cd9a83b8d3e6216375615b8f5
github.com/haxtheweb/issues
github.com/haxtheweb/issues/security/advisories/GHSA-v3ph-2q5q-cg88
nvd.nist.gov/vuln/detail/CVE-2025-49139

Code Behaviors & Features

Detect and mitigate CVE-2025-49139 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →