Medium severity · published Apr 23, 2024
CVE-2024-32875
Hugo doesn't escape markdown title in internal render hooks
6.1
CVSS
0.5%
EPSS
No
On KEV
Description
Hugo is a static site generator. Starting in version 0.123.0 and prior to version 0.125.3, title arguments in Markdown for links and images not escaped in internal render hooks. Hugo users who are impacted are those who have these hooks enabled and do not trust their Markdown content files. The issue is patched in v0.125.3. As a workaround, replace the templates with user defined templates or disable the internal templates.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 45% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
HU
hugo · gohugoio
>= 0.123.0, < 0.125.3 · source: vendor, CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-32875
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-32875
github.com
https://github.com/gohugoio/hugo/releases/tag/v0.125.3
github.com
https://github.com/gohugoio/hugo/security/advisories/GHSA-ppf8-hhpp-f5hj
gohugo.io
https://gohugo.io/getting-started/configuration-markup/#renderhooksimageenabledefault
More from hugo
9.8
CVE-2026-89259
Hugo before v0.165.0 Insufficient Permission Restriction via TailwindCSS
8.6
CVE-2026-75926
Hugo 0.162.0 to 0.164.x - Node Permission Model Bypass via Default TailwindCSS Child-Process Grant
8.4
CVE-2026-100693
Hugo v0.162.0 before v0.166.0 IP-literal Deny Rule Bypass
8.1
CVE-2026-44301
Hugo: Node tool execution allows file system access outside the project directory
7.5
CVE-2026-100692
Hugo before v0.166.0 Path Traversal via Symlinked Mount Roots