GHSA-ppf8-hhpp-f5hj
Hugo Markdown titles do not escaped in internal render hooks
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Go | github.com/gohugoio/hugo | >= 0.123.0, < 0.125.3 | 0.125.3 |
Details
As written in the advisory (Markdown source, shown as plain text).
### Impact
Title argument in Markdown for links and images not escaped in internal render hooks. Impacted are Hugo users who have these hooks enabled and do not trust their Markdown content files.
### Patches
Patched in v0.125.3.
### Workarounds
Replace with user defined templates or disable the internal templates: https://gohugo.io/getting-started/configuration-markup/#renderhooksimageenabledefault
### References
https://github.com/gohugoio/hugo/releases/tag/v0.125.3
References
External links from the advisory. They lead to third-party sites.
- https://github.com/gohugoio/hugo/security/advisories/GHSA-ppf8-hhpp-f5hj
- https://nvd.nist.gov/vuln/detail/CVE-2024-32875
- https://github.com/gohugoio/hugo/commit/15a4b9b33715887001f6eff30721d41c0d4cfdd1
- https://github.com/gohugoio/hugo
- https://github.com/gohugoio/hugo/releases/tag/v0.125.3
- https://gohugo.io/getting-started/configuration-markup/#renderhooksimageenabledefault
- https://pkg.go.dev/vuln/GO-2024-2747