Vulnerability · Published Dec 9, 2024 · Assigned by GitHub_M

CVE-2024-55601Hugo does not escape some attributes in internal templates

Medium 5.3

In plain English

A medium-severity cross-site scripting in hugo from gohugoio. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 49% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)5.3Medium

Exploit odds (30 days)0.6%top 51.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Hugo is a static site generator. Starting in version 0.123.0 and prior to version 0.139.4, some HTML attributes in Markdown in the internal templates listed below not escaped in internal render hooks. Those whoa re impacted are Hugo users who do not trust their Markdown content files and are using one or more of these templates: `_default/_markup/render-link.html` from `v0.123.0`; `_default/_markup/render-image.html` from `v0.123.0`; `_default/_markup/render-table.html` from `v0.134.0`; and/or `shortcodes/youtube.html` from `v0.125.0`. This issue is patched in v0.139.4. As a workaround, one may replace an affected component with user defined templates or disable the internal templates.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Alpine:v3.22	hugo	0.140.1-r0	ALPINE-CVE-2024-55601
Alpine:v3.23	hugo	0.140.1-r0	ALPINE-CVE-2024-55601
Alpine:v3.24	hugo	0.140.1-r0	ALPINE-CVE-2024-55601
Debian:13	hugo	no fix listed	DEBIAN-CVE-2024-55601
Debian:14	hugo	0.150.0-1	DEBIAN-CVE-2024-55601
Go	github.com/gohugoio/hugo	0.139.4	GO-2024-3314
Go	github.com/gohugoio/hugo	0.139.4	GHSA-c2xf-9v2r-r2rx
Ubuntu:22.04:LTS	hugo	no fix listed	UBUNTU-CVE-2024-55601
Ubuntu:25.10	hugo	no fix listed	UBUNTU-CVE-2024-55601
Ubuntu:26.04:LTS	hugo	no fix listed	UBUNTU-CVE-2024-55601
Ubuntu:26.10	hugo	no fix listed	UBUNTU-CVE-2024-55601

Affected products (as reported)

Vendor	Product	Versions
gohugoio	hugo	>= 0.123.0, < 0.139.4

Weakness: CWE-79 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

References

https://github.com/gohugoio/hugo/security/advisories/GHSA-c2xf-9v2r-r2rx x_refsource_CONFIRM
https://github.com/gohugoio/hugo/commit/54398f8d572c689f9785d59e907fd910a23401b0 x_refsource_MISC
https://github.com/gohugoio/hugo/releases/tag/v0.139.4 x_refsource_MISC
https://gohugo.io/getting-started/configuration-markup/#renderhooksimageenabledefault x_refsource_MISC