CVE-2025-54128: NodeJS version of HAX CMS Has Disabled Content Security Policy That Enables Cross-Site Scripting

The vulnerability, identified as GHSA-59g8-h5f-8hjp, is a configuration issue within the main application file src/app.js of the HAX CMS NodeJS version. It is not contained within a specific, named function. The vulnerability is the explicit disabling of the Content Security Policy (CSP) via the helmet middleware configuration. The patch ddb9351c6d6418008d4084a5b17fd6d611bc4e30 shows the removal of app.use(helmet({ contentSecurityPolicy: false, ... })); and its replacement with a proper CSP configuration. This line of code is executed at the top level of the app.js module during the application's startup and initialization phase. As such, there is no function signature that would appear in a runtime profiler that directly corresponds to this misconfiguration. The vulnerability is a lack of a security control at the application level, which would allow for Cross-Site Scripting (XSS) attacks if another vulnerability that allows for injecting scripts exists.