GHSA-59g8-h59f-8hjp

Suggest an improvement
Source
https://github.com/advisories/GHSA-59g8-h59f-8hjp
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/07/GHSA-59g8-h59f-8hjp/GHSA-59g8-h59f-8hjp.json
JSON Data
https://api.test.osv.dev/v1/vulns/GHSA-59g8-h59f-8hjp
Aliases
Published
2025-07-21T19:51:14Z
Modified
2025-07-21T22:21:25Z
Severity
  • 7.2 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:H/SC:L/SI:L/SA:N CVSS Calculator
Summary
NodeJS version of HAX CMS Has Disabled Content Security Policy That Enables Cross-Site Scripting
Details

Summary

The NodeJS version of HAX CMS has a disabled Content Security Policy (CSP). This configuration is insecure for a production application because it does not protect against cross-site-scripting attacks.

Details

The contentSecurityPolicy value is explicitly disabled in the application's Helmet configuration in app.js.

permissive-csp-code

Affected Resources

PoC

To reproduce this vulnerability, install HAX CMS NodeJS. The application will load without a CSP configured.

Impact

In conjunction with an XSS vulnerability, an attacker could execute arbitrary scripts and exfiltrate data, including session tokens and sensitive local data.

Additional Information

Database specific 
{
    "cwe_ids":  [
        "CWE-79"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2025-07-21T19:51:14Z",
    "nvd_published_at":  "2025-07-21T21:15:26Z",
    "severity":  "HIGH"
}
References

Affected packages

npm / @haxtheweb/haxcms-nodejs

Package

Name
@haxtheweb/haxcms-nodejs
View open source insights on deps.dev
Purl
pkg:npm/%40haxtheweb/haxcms-nodejs

Affected ranges

Type
SEMVER
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
11.0.8

Database specific

last_known_affected_version_range 
"<= 11.0.7"
source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/07/GHSA-59g8-h59f-8hjp/GHSA-59g8-h59f-8hjp.json"