GitHub Advisoryadvisory · Go
GHSA-c2xf-9v2r-r2rx Hugo does not escape some attributes in internal templates
MEDIUM
Official page ↗
- Aliases
- CVE-2024-55601
- Ecosystem
- Go
- Packages
- github.com/gohugoio/hugo
- Severity
- Moderate
- CVSS vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
- Weaknesses
- CWE-79
- Reviewed
- 2024-12-09
Affected packages
• Go github.com/gohugoio/hugo: >= 0.123.0, < 0.139.4 → fixed in 0.139.4
Description
Impact
Some HTML attributes in Markdown in the internal templates listed below not escaped. Impacted are Hugo users who do not trust their Markdown content files and are using one or more of these templates.
• `_default/_markup/render-link.html` from `v0.123.0`
• `_default/_markup/render-image.html` from `v0.123.0`
• `_default/_markup/render-table.html` from `v0.134.0`
• `shortcodes/youtube.html` from `v0.125.0`
Patches
Patched in v0.139.4.
Workarounds
Replace with user defined templates or disable the internal templates: https://gohugo.io/getting-started/configuration-markup/#renderhooksimageenabledefault
References
• https://github.com/gohugoio/hugo/releases/tag/v0.139.4
• https://gohugo.io/about/security/
Related
Alias · CVE (1)
- CVE-2024-55601 Hugo is a static site generator. vulnerability
Weakness · CWE (1)
- CWE-79 Improper Neutralization of Input During Web Page Generation weakness
References
- https://github.com/gohugoio/hugo/security/advisories/GHSA-c2xf-9v2r-r2rx web
- https://nvd.nist.gov/vuln/detail/CVE-2024-55601 advisory
- https://github.com/gohugoio/hugo/commit/54398f8d572c689f9785d59e907fd910a23401b0 web
- https://github.com/gohugoio/hugo package
- https://github.com/gohugoio/hugo/releases/tag/v0.139.4 web
- https://gohugo.io/getting-started/configuration-markup/#renderhooksimageenabledefault web