GHSA-q54r-r9pr-w7qv

Hexo Vulnerable to XSS

Source: GitHub Advisory Database (reviewed) Moderate CVE-2021-25987

Packages

Ecosystem	Package	Affected	Fixed in
npm	hexo	>= 0.0.1, < 6.0.0	6.0.0

Details

As written in the advisory (Markdown source, shown as plain text).

Hexo versions 0.0.1 to 5.4.0 are vulnerable against stored XSS. The post “body” and “tags” don’t sanitize malicious javascript during web page generation. Local unprivileged attacker can inject arbitrary code.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2021-25987 advisory
https://github.com/hexojs/hexo/issues/4838 web
https://github.com/hexojs/hexo/pull/4750 web
https://github.com/hexojs/hexo/commit/5170df2d3fa9c69e855c4b7c2b084ebfd92d5200 web
https://github.com/hexojs/hexo package
https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25987 web