medium6.1
CVE-2024-32875
Hugo Markdown titles do not escaped in internal render hooks
Impact
### Impact Title argument in Markdown for links and images not escaped in internal render hooks. Impacted are Hugo users who have these hooks enabled and do not trust their Markdown content files. ### Patches Patched in v0.125.3. ### Workarounds Replace with user defined templates or disable the internal templates: https://gohugo.io/getting-started/configuration-markup/#renderhooksimageenabledefault ### References https://github.com/gohugoio/hugo/releases/tag/v0.125.3
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| go | github.com/gohugoio/hugo | >= 0.123.0, < 0.125.3 | 0.125.3 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/gohugoio/hugo/releases/tag/v0.125.3
- https://github.com/gohugoio/hugo/security/advisories/GHSA-ppf8-hhpp-f5hj
- https://gohugo.io/getting-started/configuration-markup/#renderhooksimageenabledefault
- https://github.com/advisories/GHSA-ppf8-hhpp-f5hj
- https://github.com/gohugoio/hugo/commit/15a4b9b33715887001f6eff30721d41c0d4cfdd1
- https://nvd.nist.gov/vuln/detail/CVE-2024-32875
- https://pkg.go.dev/vuln/GO-2024-2747