Vulnerability · Published Apr 23, 2024 · Assigned by GitHub_M

CVE-2024-32875Hugo doesn't escape markdown title in internal render hooks

Medium 6.1

In plain English

A medium-severity cross-site scripting in hugo from gohugoio. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 45% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.1Medium

Exploit odds (30 days)0.5%top 54.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Hugo is a static site generator. Starting in version 0.123.0 and prior to version 0.125.3, title arguments in Markdown for links and images not escaped in internal render hooks. Hugo users who are impacted are those who have these hooks enabled and do not trust their Markdown content files. The issue is patched in v0.125.3. As a workaround, replace the templates with user defined templates or disable the internal templates.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:13	hugo	0.125.4-1	DEBIAN-CVE-2024-32875
Debian:14	hugo	0.125.4-1	DEBIAN-CVE-2024-32875
Go	github.com/gohugoio/hugo	0.125.3	GHSA-ppf8-hhpp-f5hj
Go	github.com/gohugoio/hugo	0.125.3	GO-2024-2747
Ubuntu:22.04:LTS	hugo	no fix listed	UBUNTU-CVE-2024-32875
Ubuntu:25.10	hugo	no fix listed	UBUNTU-CVE-2024-32875
Ubuntu:26.04:LTS	hugo	no fix listed	UBUNTU-CVE-2024-32875
Ubuntu:26.10	hugo	no fix listed	UBUNTU-CVE-2024-32875

Affected products (as reported)

Vendor	Product	Versions
gohugoio	hugo	>= 0.123.0, < 0.125.3

Weakness: CWE-80, CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

References

https://github.com/gohugoio/hugo/security/advisories/GHSA-ppf8-hhpp-f5hj x_refsource_CONFIRM
https://github.com/gohugoio/hugo/releases/tag/v0.125.3 x_refsource_MISC
https://gohugo.io/getting-started/configuration-markup/#renderhooksimageenabledefault x_refsource_MISC