GitHub Advisoryadvisory · npm

GHSA-q54r-r9pr-w7qv Hexo Vulnerable to XSS

MEDIUM Published 2021-12-01 Modified 2023-09-13 Official page ↗
Aliases
CVE-2021-25987
Ecosystem
npm
Packages
hexo
Severity
Moderate
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2021-12-01

Affected packages

• npm hexo: >= 0.0.1, < 6.0.0 → fixed in 6.0.0

Description

Hexo versions 0.0.1 to 5.4.0 are vulnerable against stored XSS. The post “body” and “tags” don’t sanitize malicious javascript during web page generation. Local unprivileged attacker can inject arbitrary code.

Related

Alias · CVE (1)

  • CVE-2021-25987 Hexo versions 0.0.1 to 5.4.0 are vulnerable against stored XSS. vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References