GitHub Advisoryadvisory · Go
GHSA-ppf8-hhpp-f5hj Hugo Markdown titles do not escaped in internal render hooks
MEDIUM
Official page ↗
- Aliases
- CVE-2024-32875
- Ecosystem
- Go
- Packages
- github.com/gohugoio/hugo
- Severity
- Moderate
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- Weaknesses
- CWE-79
- Reviewed
- 2024-04-23
Affected packages
• Go github.com/gohugoio/hugo: >= 0.123.0, < 0.125.3 → fixed in 0.125.3
Description
Impact
Title argument in Markdown for links and images not escaped in internal render hooks. Impacted are Hugo users who have these hooks enabled and do not trust their Markdown content files.
Patches
Patched in v0.125.3.
Workarounds
Replace with user defined templates or disable the internal templates: https://gohugo.io/getting-started/configuration-markup/#renderhooksimageenabledefault
References
https://github.com/gohugoio/hugo/releases/tag/v0.125.3
Related
Alias · CVE (1)
- CVE-2024-32875 Hugo is a static site generator. vulnerability
Weakness · CWE (1)
- CWE-79 Improper Neutralization of Input During Web Page Generation weakness
References
- https://github.com/gohugoio/hugo/security/advisories/GHSA-ppf8-hhpp-f5hj web
- https://nvd.nist.gov/vuln/detail/CVE-2024-32875 advisory
- https://github.com/gohugoio/hugo/commit/15a4b9b33715887001f6eff30721d41c0d4cfdd1 web
- https://github.com/gohugoio/hugo package
- https://github.com/gohugoio/hugo/releases/tag/v0.125.3 web
- https://gohugo.io/getting-started/configuration-markup/#renderhooksimageenabledefault web
- https://pkg.go.dev/vuln/GO-2024-2747 web