cve-2026-46391

CVE-2026-46391 - 通过 SSRF 暴露 @haxtheweb/open-apis 中的凭证 CVE-2026-46391 的概念验证。触发 @haxtheweb/open-apis 中 cacheAddress 端点的 SSRF 漏洞，并捕获回调中发送的服务账户凭证。 构建 go build -o cve-2026-46391 . 测试 go test ./... 用法 ./cve-2026-46391 -u -l -p 端口 -t 秒 -v 选项 标志| 描述| 默认值 ---|---|--- -u, --url| 目标 Web 根目录（例如...

CVE-2026-46391: Permissive List of Allowed Inputs

HAX CMS helps manage microsite universe with PHP or NodeJs backends. Starting in version 9.0.1 and prior to version 26.0.0 of @haxtheweb/open-apis, multiple functions conduct substring-only matching to validate hostnames to which basic authorization should be sent. An attacker can append the...

Cross-site Scripting (XSS)

Overview @haxtheweb/haxcms-nodejs is a HAXcms nodejs backend Affected versions of this package are vulnerable to Cross-site Scripting XSS via improper sanitization of elements that allow javascript: URIs in the src attribute. An attacker can execute arbitrary JavaScript in the victim's browser...

CVE-2026-46357

creationtimestamp| type| source ---|---|--- 2026-05-13 18:46:15+00:00| published-proof-of-concept| https://github.com/haxtheweb/issues/security/advisories/GHSA-9r33-xhw8-4qqp 2026-06-05 21:20:07+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mnl2wssjwa2z...

@haxtheweb/create (>=0.1.3, <=26.0.0), @haxtheweb/haxcms-nodejs (>=0.0.2, <=25.0.0) +3 more potentially affected by CVE-2026-25521 via locutus (>=2.0.14, <=2.0.32)

locutus NPM version =2.0.14, =0.1.3, =0.0.2, =11.0.2, =2.1.1, =1.0.66, =1.0.72 Source cves: CVE-2026-25521 Source advisory: OSV:GHSA-RXRV-835Q-V5MH...

@haxtheweb/create (>=0.1.3, <=26.0.0), @haxtheweb/haxcms-nodejs (>=0.0.2, <=25.0.0) +3 more potentially affected by CVE-2026-25521 via locutus (>=2.0.14, <=2.0.32)

locutus NPM version =2.0.14, =0.1.3, =0.0.2, =11.0.2, =2.1.1, =1.0.66, =1.0.72 Source cves: CVE-2026-25521 Source advisory: SNYK:JS-LOCUTUS-15182766...

@haxtheweb/create (>=10.0.0, <=11.0.2), @haxtheweb/open-apis (11.0.2) potentially affected by CVE-2025-48996 via @haxtheweb/open-apis (10.0.1)

@haxtheweb/open-apis NPM version 10.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on @haxtheweb/open-apis and may be impacted: - @haxtheweb/create =10.0.0, =11.0.2 - @haxtheweb/open-apis 11.0.2 Source cves: CVE-2025-48996 Source advisory:...