Is @haxtheweb/iframe-loader safe?

GHSA-jh3h-rpxg-fr36

A stored cross-site scripting (XSS) vulnerability exists in HAX CMS due to improper sanitization of elements.

The application allows javascript: URIs in the src attribute, which are executed when a malicious page is viewed. This enables attackers to execute arbitrary JavaScript in the context of the victim’s browser and access sensitive data exposed to client-side scripts.

Successful exploitation allows access to any data available in the browser context, including:

• Authentication tokens (e.g., JWT)
• Session cookies (if not protected with HttpOnly)
• Application configuration (e.g., window.appSettings)
• User-specific data accessible via APIs

This significantly increases the impact beyond simple script execution.

Steps to reproduce:

• Log in to HAX CMS as any authenticated user.
• Create a new page or edit an existing page.
• Open the HTML source editor (<>).
• Insert the following payload:

This vulnerability allows stored XSS leading to:

• Execution of arbitrary JavaScript in victim browsers
• Access to sensitive client-side data, including authentication tokens and session identifiers
• Unauthorized API actions performed on behalf of the victim
• Session hijacking and full account takeover

Because the application exposes authentication data in the client-side environment, exploitation of this vulnerability can lead to complete compromise of user accounts and site content.