The vulnerability CVE-2026-48527 is a stored cross-site scripting (CWE-79) in haxtheweb's haxcms-nodejs product. It affects versions prior to 26.0.1 and allows an authenticated user with permission to edit pages to inject malicious event handler attributes in the /system/api/saveNode endpoint. The injection bypasses the HTML sanitizer by omitting whitespace before the attribute name, enabling persistent XSS attacks. This can compromise confidentiality and integrity of user sessions. The vendor has released patched versions 26.0.1 (NodeJS) and 26.0.2 (PHP) to address this issue.

Successful exploitation allows an authenticated user with edit permissions to execute arbitrary scripts in the context of the vulnerable web application. This can lead to full compromise of user sessions, data theft, and unauthorized actions within the application. The CVSS score of 8.7 (high severity) reflects the network attack vector, low attack complexity, required privileges, and significant impact on confidentiality and integrity.

A fix is available: upgrade haxcms-nodejs to version 26.0.1 or later, or haxcms-php to version 26.0.2 or later. Applying these official patches will remediate the vulnerability. No additional vendor advisory was provided; therefore, patch status is based on the version information in the description.