CVE-2024-32875

Hugo doesn't escape markdown title in internal render hooks

CVSS 6.1 MEDIUMEPSS 0.5%CWE-79 CWE-80

Vexday Risk Score

13Baixo

Decisão SSVC (CISA)

Track

Sem sinal de exploração → monitorar

CVSS 6.1EPSS 0.5%KEV nãoPoC —Nuclei —Metasploit —Patch —

Ciclo de vida

23 abr 2024Publicada no NVD

Recomendação: Monitorar — sem sinal de exploração no momento.

Hugo is a static site generator. Starting in version 0.123.0 and prior to version 0.125.3, title arguments in Markdown for links and images not escaped in internal render hooks. Hugo users who are impacted are those who have these hooks enabled and do not trust their Markdown content files. The issue is patched in v0.125.3. As a workaround, replace the templates with user defined templates or disable the internal templates.

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Produtos afetados

gohugoio · hugo

Quer saber se a sua infraestrutura está exposta a isto?

Falar com a TrueHacking →

Referências

https://github.com/gohugoio/hugo/releases/tag/v0.125.3 https://github.com/gohugoio/hugo/security/advisories/GHSA-ppf8-hhpp-f5hj https://gohugo.io/getting-started/configuration-markup/#renderhooksimageenabledefault