All the vulnerabilites related to gohugoio - hugo
cve-2024-55601
Vulnerability from cvelistv5
Published
2024-12-09 21:11
Modified
2024-12-10 17:13
Severity ?
EPSS score ?
Summary
Hugo is a static site generator. Starting in version 0.123.0 and prior to version 0.139.4, some HTML attributes in Markdown in the internal templates listed below not escaped in internal render hooks. Those whoa re impacted are Hugo users who do not trust their Markdown content files and are using one or more of these templates: `_default/_markup/render-link.html` from `v0.123.0`; `_default/_markup/render-image.html` from `v0.123.0`; `_default/_markup/render-table.html` from `v0.134.0`; and/or `shortcodes/youtube.html` from `v0.125.0`. This issue is patched in v0.139.4. As a workaround, one may replace an affected component with user defined templates or disable the internal templates.
References
| ▼ | URL | Tags |
|---|---|---|
| https://github.com/gohugoio/hugo/security/advisories/GHSA-c2xf-9v2r-r2rx | x_refsource_CONFIRM | |
| https://github.com/gohugoio/hugo/commit/54398f8d572c689f9785d59e907fd910a23401b0 | x_refsource_MISC | |
| https://github.com/gohugoio/hugo/releases/tag/v0.139.4 | x_refsource_MISC | |
| https://gohugo.io/getting-started/configuration-markup/#renderhooksimageenabledefault | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-55601",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-12-10T16:09:30.192956Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-12-10T17:13:48.519Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "hugo",
"vendor": "gohugoio",
"versions": [
{
"status": "affected",
"version": "\u003e= 0.123.0, \u003c 0.139.4"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Hugo is a static site generator. Starting in version 0.123.0 and prior to version 0.139.4, some HTML attributes in Markdown in the internal templates listed below not escaped in internal render hooks. Those whoa re impacted are Hugo users who do not trust their Markdown content files and are using one or more of these templates: `_default/_markup/render-link.html` from `v0.123.0`; `_default/_markup/render-image.html` from `v0.123.0`; `_default/_markup/render-table.html` from `v0.134.0`; and/or `shortcodes/youtube.html` from `v0.125.0`. This issue is patched in v0.139.4. As a workaround, one may replace an affected component with user defined templates or disable the internal templates."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-12-09T21:11:10.463Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/gohugoio/hugo/security/advisories/GHSA-c2xf-9v2r-r2rx",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/gohugoio/hugo/security/advisories/GHSA-c2xf-9v2r-r2rx"
},
{
"name": "https://github.com/gohugoio/hugo/commit/54398f8d572c689f9785d59e907fd910a23401b0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/gohugoio/hugo/commit/54398f8d572c689f9785d59e907fd910a23401b0"
},
{
"name": "https://github.com/gohugoio/hugo/releases/tag/v0.139.4",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/gohugoio/hugo/releases/tag/v0.139.4"
},
{
"name": "https://gohugo.io/getting-started/configuration-markup/#renderhooksimageenabledefault",
"tags": [
"x_refsource_MISC"
],
"url": "https://gohugo.io/getting-started/configuration-markup/#renderhooksimageenabledefault"
}
],
"source": {
"advisory": "GHSA-c2xf-9v2r-r2rx",
"discovery": "UNKNOWN"
},
"title": "Hugo does not escape some attributes in internal templates"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2024-55601",
"datePublished": "2024-12-09T21:11:10.463Z",
"dateReserved": "2024-12-09T14:22:52.524Z",
"dateUpdated": "2024-12-10T17:13:48.519Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2024-32875
Vulnerability from cvelistv5
Published
2024-04-23 20:23
Modified
2024-08-02 02:20
Severity ?
EPSS score ?
Summary
Hugo is a static site generator. Starting in version 0.123.0 and prior to version 0.125.3, title arguments in Markdown for links and images not escaped in internal render hooks. Hugo users who are impacted are those who have these hooks enabled and do not trust their Markdown content files. The issue is patched in v0.125.3. As a workaround, replace the templates with user defined templates or disable the internal templates.
References
| ▼ | URL | Tags |
|---|---|---|
| https://github.com/gohugoio/hugo/security/advisories/GHSA-ppf8-hhpp-f5hj | x_refsource_CONFIRM | |
| https://github.com/gohugoio/hugo/releases/tag/v0.125.3 | x_refsource_MISC | |
| https://gohugo.io/getting-started/configuration-markup/#renderhooksimageenabledefault | x_refsource_MISC |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:gohugo:hugo:0.123.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "hugo",
"vendor": "gohugo",
"versions": [
{
"lessThan": "0.125.3",
"status": "affected",
"version": "0.123.0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-32875",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-04-29T19:39:12.988615Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-06-04T17:51:21.525Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T02:20:35.602Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "https://github.com/gohugoio/hugo/security/advisories/GHSA-ppf8-hhpp-f5hj",
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/gohugoio/hugo/security/advisories/GHSA-ppf8-hhpp-f5hj"
},
{
"name": "https://github.com/gohugoio/hugo/releases/tag/v0.125.3",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/gohugoio/hugo/releases/tag/v0.125.3"
},
{
"name": "https://gohugo.io/getting-started/configuration-markup/#renderhooksimageenabledefault",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://gohugo.io/getting-started/configuration-markup/#renderhooksimageenabledefault"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "hugo",
"vendor": "gohugoio",
"versions": [
{
"status": "affected",
"version": "\u003e= 0.123.0, \u003c 0.125.3"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Hugo is a static site generator. Starting in version 0.123.0 and prior to version 0.125.3, title arguments in Markdown for links and images not escaped in internal render hooks. Hugo users who are impacted are those who have these hooks enabled and do not trust their Markdown content files. The issue is patched in v0.125.3. As a workaround, replace the templates with user defined templates or disable the internal templates."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-80",
"description": "CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-04-23T20:23:42.535Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/gohugoio/hugo/security/advisories/GHSA-ppf8-hhpp-f5hj",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/gohugoio/hugo/security/advisories/GHSA-ppf8-hhpp-f5hj"
},
{
"name": "https://github.com/gohugoio/hugo/releases/tag/v0.125.3",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/gohugoio/hugo/releases/tag/v0.125.3"
},
{
"name": "https://gohugo.io/getting-started/configuration-markup/#renderhooksimageenabledefault",
"tags": [
"x_refsource_MISC"
],
"url": "https://gohugo.io/getting-started/configuration-markup/#renderhooksimageenabledefault"
}
],
"source": {
"advisory": "GHSA-ppf8-hhpp-f5hj",
"discovery": "UNKNOWN"
},
"title": "Hugo doesn\u0027t escape markdown title in internal render hooks"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2024-32875",
"datePublished": "2024-04-23T20:23:42.535Z",
"dateReserved": "2024-04-19T14:07:11.229Z",
"dateUpdated": "2024-08-02T02:20:35.602Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2020-26284
Vulnerability from cvelistv5
Published
2020-12-21 22:40
Modified
2024-08-04 15:56
Severity ?
EPSS score ?
Summary
Hugo is a fast and Flexible Static Site Generator built in Go. Hugo depends on Go's `os/exec` for certain features, e.g. for rendering of Pandoc documents if these binaries are found in the system `%PATH%` on Windows. In Hugo before version 0.79.1, if a malicious file with the same name (`exe` or `bat`) is found in the current working directory at the time of running `hugo`, the malicious command will be invoked instead of the system one. Windows users who run `hugo` inside untrusted Hugo sites are affected. Users should upgrade to Hugo v0.79.1. Other than avoiding untrusted Hugo sites, there is no workaround.
References
| ▼ | URL | Tags |
|---|---|---|
| https://github.com/gohugoio/hugo/security/advisories/GHSA-8j34-9876-pvfq | x_refsource_CONFIRM | |
| https://github.com/golang/go/issues/38736 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T15:56:03.976Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/gohugoio/hugo/security/advisories/GHSA-8j34-9876-pvfq"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/golang/go/issues/38736"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "hugo",
"vendor": "gohugoio",
"versions": [
{
"status": "affected",
"version": "\u003c 0.79.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Hugo is a fast and Flexible Static Site Generator built in Go. Hugo depends on Go\u0027s `os/exec` for certain features, e.g. for rendering of Pandoc documents if these binaries are found in the system `%PATH%` on Windows. In Hugo before version 0.79.1, if a malicious file with the same name (`exe` or `bat`) is found in the current working directory at the time of running `hugo`, the malicious command will be invoked instead of the system one. Windows users who run `hugo` inside untrusted Hugo sites are affected. Users should upgrade to Hugo v0.79.1. Other than avoiding untrusted Hugo sites, there is no workaround."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-12-21T22:40:15",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/gohugoio/hugo/security/advisories/GHSA-8j34-9876-pvfq"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/golang/go/issues/38736"
}
],
"source": {
"advisory": "GHSA-8j34-9876-pvfq",
"discovery": "UNKNOWN"
},
"title": "Hugo can execute a binary from the current directory on Windows",
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "security-advisories@github.com",
"ID": "CVE-2020-26284",
"STATE": "PUBLIC",
"TITLE": "Hugo can execute a binary from the current directory on Windows"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "hugo",
"version": {
"version_data": [
{
"version_value": "\u003c 0.79.1"
}
]
}
}
]
},
"vendor_name": "gohugoio"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Hugo is a fast and Flexible Static Site Generator built in Go. Hugo depends on Go\u0027s `os/exec` for certain features, e.g. for rendering of Pandoc documents if these binaries are found in the system `%PATH%` on Windows. In Hugo before version 0.79.1, if a malicious file with the same name (`exe` or `bat`) is found in the current working directory at the time of running `hugo`, the malicious command will be invoked instead of the system one. Windows users who run `hugo` inside untrusted Hugo sites are affected. Users should upgrade to Hugo v0.79.1. Other than avoiding untrusted Hugo sites, there is no workaround."
}
]
},
"impact": {
"cvss": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-78: Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/gohugoio/hugo/security/advisories/GHSA-8j34-9876-pvfq",
"refsource": "CONFIRM",
"url": "https://github.com/gohugoio/hugo/security/advisories/GHSA-8j34-9876-pvfq"
},
{
"name": "https://github.com/golang/go/issues/38736",
"refsource": "MISC",
"url": "https://github.com/golang/go/issues/38736"
}
]
},
"source": {
"advisory": "GHSA-8j34-9876-pvfq",
"discovery": "UNKNOWN"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2020-26284",
"datePublished": "2020-12-21T22:40:15",
"dateReserved": "2020-10-01T00:00:00",
"dateUpdated": "2024-08-04T15:56:03.976Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}