GHSA-ppf8-hhpp-f5hjMediumCVSS 6.1
Hugo Markdown titles do not escaped in internal render hooks
🔗 CVE IDs covered (1)
📋 Description
Impact
Title argument in Markdown for links and images not escaped in internal render hooks. Impacted are Hugo users who have these hooks enabled and do not trust their Markdown content files.
Patches
Patched in v0.125.3.
Workarounds
Replace with user defined templates or disable the internal templates: https://gohugo.io/getting-started/configuration-markup/#renderhooksimageenabledefault
References
https://github.com/gohugoio/hugo/releases/tag/v0.125.3
🎯 Affected products1
- go/github.com/gohugoio/hugo:>= 0.123.0, < 0.125.3
🔗 References (7)
- https://github.com/gohugoio/hugo/security/advisories/GHSA-ppf8-hhpp-f5hj
- https://github.com/gohugoio/hugo/commit/15a4b9b33715887001f6eff30721d41c0d4cfdd1
- https://github.com/gohugoio/hugo/releases/tag/v0.125.3
- https://nvd.nist.gov/vuln/detail/CVE-2024-32875
- https://gohugo.io/getting-started/configuration-markup/#renderhooksimageenabledefault
- https://pkg.go.dev/vuln/GO-2024-2747
- https://github.com/advisories/GHSA-ppf8-hhpp-f5hj