gohugoio/hugo · Security
Hugo Markdown titles do not escaped in internal render hooks
- GHSA ID
- GHSA-ppf8-hhpp-f5hj
- CVE ID
- CVE-2024-32875
- Severity
- medium
- Published
- Updated
- CVSS
- 6.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- CVSS v3
- 6.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Description
Impact
Title argument in Markdown for links and images not escaped in internal render hooks. Impacted are Hugo users who have these hooks enabled and do not trust their Markdown content files.
Patches
Patched in v0.125.3.
Workarounds
Replace with user defined templates or disable the internal templates: https://gohugo.io/getting-started/configuration-markup/#renderhooksimageenabledefault
References
CWEs
- CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
References
- https://github.com/gohugoio/hugo/security/advisories/GHSA-ppf8-hhpp-f5hj ↗
- https://github.com/gohugoio/hugo/commit/15a4b9b33715887001f6eff30721d41c0d4cfdd1 ↗
- https://github.com/gohugoio/hugo/releases/tag/v0.125.3 ↗
- https://nvd.nist.gov/vuln/detail/CVE-2024-32875 ↗
- https://gohugo.io/getting-started/configuration-markup/#renderhooksimageenabledefault ↗
- https://pkg.go.dev/vuln/GO-2024-2747 ↗
- https://github.com/advisories/GHSA-ppf8-hhpp-f5hj ↗