hexojs/hexo · Security
Hexo Vulnerable to XSS
- GHSA ID
- GHSA-q54r-r9pr-w7qv
- CVE ID
- CVE-2021-25987
- Severity
- medium
- Published
- Updated
- CVSS
- 4.6 · CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
- CVSS v3
- 4.6 · CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Description
Hexo versions 0.0.1 to 5.4.0 are vulnerable against stored XSS. The post “body” and “tags” don’t sanitize malicious javascript during web page generation. Local unprivileged attacker can inject arbitrary code.
CWEs
- CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
References
- https://nvd.nist.gov/vuln/detail/CVE-2021-25987 ↗
- https://github.com/hexojs/hexo/commit/5170df2d3fa9c69e855c4b7c2b084ebfd92d5200 ↗
- https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25987 ↗
- https://github.com/hexojs/hexo/issues/4838 ↗
- https://github.com/hexojs/hexo/pull/4750 ↗
- https://github.com/advisories/GHSA-q54r-r9pr-w7qv ↗