CVE-2025-54128: NodeJS version of HAX CMS Has Disabled Content Security Policy That Enables Cross-Site Scripting

July 21, 2025 (updated November 10, 2025)

The NodeJS version of HAX CMS has a disabled Content Security Policy (CSP). This configuration is insecure for a production application because it does not protect against cross-site-scripting attacks.

References

github.com/advisories/GHSA-59g8-h59f-8hjp
github.com/haxtheweb/haxcms-nodejs
github.com/haxtheweb/haxcms-nodejs/commit/ddb9351c6d6418008d4084a5b17fd6d611bc4e30
github.com/haxtheweb/issues/security/advisories/GHSA-59g8-h59f-8hjp
nvd.nist.gov/vuln/detail/CVE-2025-54128

Code Behaviors & Features

Detect and mitigate CVE-2025-54128 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →