CVE-2024-32875

EUVD-2024-1268
Hugo is a static site generator. Starting in version 0.123.0 and prior to version 0.125.3, title arguments in Markdown for links and images not escaped in internal render hooks. Hugo users who are impacted are those who have these hooks enabled and do not trust their Markdown content files. The issue is patched in v0.125.3. As a workaround, replace the templates with user defined templates or disable the internal templates.
Cross-site Scripting
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
6.1 MEDIUM
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 43%
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
gohugohugo
0.123.0 ≤
𝑥
< 0.125.3
ADP
Debian logo
Debian Releases
Debian Product
Codename
hugo
bookworm
0.111.3-1
not-affected
bullseye
0.80.0-6
not-affected
bullseye (security)
0.80.0-6+deb11u1
fixed
buster
not-affected
forky
0.152.2-1
fixed
sid
0.153.2-1
fixed
trixie
0.131.0-1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
hugo
bionic
needs-triage
focal
needs-triage
jammy
needs-triage
mantic
ignored
noble
needs-triage
oracular
ignored
plucky
needs-triage
questing
needs-triage
xenial
needs-triage
Common Weakness Enumeration
References
https://github.com/gohugoio/hugo/releases/tag/v0.125.3
https://github.com/gohugoio/hugo/security/advisories/GHSA-ppf8-hhpp-f5hj
https://gohugo.io/getting-started/configuration-markup/#renderhooksimageenabledefault
https://github.com/gohugoio/hugo/releases/tag/v0.125.3
https://github.com/gohugoio/hugo/security/advisories/GHSA-ppf8-hhpp-f5hj
https://gohugo.io/getting-started/configuration-markup/#renderhooksimageenabledefault