Description (CNA)
Hexo versions 0.0.1 to 5.4.0 are vulnerable against stored XSS. The post “body” and “tags” don’t sanitize malicious javascript during web page generation. Local unprivileged attacker can inject arbitrary code.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Hexo / Hexo | affected unspecified through 5.4.0; affected next of 0.0.1 before unspecified |
CWE
CWE-79
References
- https://github.com/hexojs/hexo/commit/5170df2d3fa9c69e855c4b7c2b084ebfd92d5200
- https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25987
ADP enrichment
No English description supplied.
No English description supplied.
No references supplied.