Homepage
About Snyk

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affecting github.com/gohugoio/hugo/tpl/tplimpl/embedded package, versions >=0.123.0 <0.125.3

0.0
medium

Snyk CVSS

    Attack Complexity Low
    User Interaction Required
    Scope Changed

    Threat Intelligence

    EPSS 0.05% (15th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk ID SNYK-GOLANG-GITHUBCOMGOHUGOIOHUGOTPLTPLIMPLEMBEDDED-6672878
  • published 24 Apr 2024
  • disclosed 23 Apr 2024
  • credit Eric Anderson
Report a new vulnerability Found a mistake?

Introduced: 23 Apr 2024

New CVE-2024-32875 Open this link in a new tab
CWE-79 Open this link in a new tab

How to fix?

Upgrade github.com/gohugoio/hugo/tpl/tplimpl/embedded to version 0.125.3 or higher.

Overview

Affected versions of this package are vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') due to the improper handling of Markdown titles in internal render hooks. An attacker can inject malicious code into Markdown files that, when processed by Hugo, can lead to cross-site scripting (XSS) if the internal render hooks are enabled and the Markdown content files are not trusted.

Note:

This is only exploitable if internal render hooks are enabled and the user does not trust their Markdown content files.

Workaround

This vulnerability can be mitigated by replacing with user-defined templates or disabling the internal templates: https://gohugo.io/getting-started/configuration-markup/#renderhooksimageenabledefault