VDB
GO-2024-2747
GO-2024-2747
PUBLISHED
Hugo Markdown titles are not escaped in internal render hooks in github.com/gohugoio/hugo
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| github.com | gohugoio/hugo | 0.123.0, 0.123.0 |
| wolfi | hugo-extended | 0, 0, 0 |
| chainguard | hugo-extended | 0, 0 |
Timeline
- Jun 4, 2024 CVE Published
- Feb 4, 2026 CVE Updated
References
- https://gohugo.io/getting-started/configuration-markup/#renderhooksimageenabledefault url
- https://github.com/gohugoio/hugo/security/advisories/GHSA-ppf8-hhpp-f5hj advisory
- https://github.com/gohugoio/hugo/commit/15a4b9b33715887001f6eff30721d41c0d4cfdd1 fix
- https://github.com/gohugoio/hugo/releases/tag/v0.125.3 fix