PT-2024-36563 · Hugo+1 · Hugo+1

Jmooring · Published 2024-12-09 · Updated 2024-12-18 · CVE-2024-55601

Positive Technologies (AI Summary)

CVSS v4.0

5.3

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions Hugo versions 0.123.0 through 0.139.4

Description The issue concerns unescaped HTML attributes in Markdown within internal templates. This affects Hugo users who do not trust their Markdown content files and are using one or more of the following templates: default/ markup/render-link.html, default/ markup/render-image.html, default/ markup/render-table.html, and/or shortcodes/youtube.html. The issue is patched in version 0.139.4.

Recommendations For Hugo versions 0.123.0 through 0.139.4, replace the affected internal templates with user-defined templates or disable the internal templates to mitigate the risk. Specifically, consider replacing or disabling the following templates: default/ markup/render-link.html, default/ markup/render-image.html, default/ markup/render-table.html, and shortcodes/youtube.html. Update to version 0.139.4 or later to fully resolve the issue.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-55601

GHSA-C2XF-9V2R-R2RX

GO-2024-3314

OPENSUSE-SU-2024:14599-1

Affected Products

Debian

Hugo

References · 41

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/55xxx/CVE-2024-55601.json · Exploit
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-55601 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2024-55601 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-55601 · Security Note
• https://cve.org/CVERecord?id=CVE-2024-55601 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2024:14599-1 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-c2xf-9v2r-r2rx · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-55601 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2024-55601 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-55601 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2024-3314 · Vendor Advisory
• https://github.com/gohugoio/hugo · Note
• https://github.com/gohugoio/hugo/releases/tag/v0.139.4 · Note
• https://github.com/gohugoio/hugo/commit/54398f8d572c689f9785d59e907fd910a23401b0 · Note
• https://github.com/gohugoio/hugo/security/advisories/GHSA-c2xf-9v2r-r2rx · Note