hexo vulnerabilities

Products

• hexo 2
• hexo themes 1

Latest hexo CVEs

Newest publication first

1. CVE-2023-47435 An issue in the verifyPassword function of hexo-theme-matery v2.0.0 allows attackers to bypass authentication and access password protected pages.

   Published 2024-04-19

   Critical·CVSS 9.8

   An issue in the verifyPassword function of hexo-theme-matery v2.0.0 allows attackers to bypass authentication and access password protected pages.

2. CVE-2023-39584 Hexo `include_code` has a path traversal

   Published 2023-09-08

   High·CVSS 7.5

   Hexo up to v7.0.0 (RC2) was discovered to contain an arbitrary file read vulnerability.

3. CVE-2021-25987 Hexo - Stored XSS

   Published 2021-11-30

   Medium·CVSS 4.6

   Hexo versions 0.0.1 to 5.4.0 are vulnerable against stored XSS. The post “body” and “tags” don’t sanitize malicious javascript during web page generation. Local unprivileged attacker can inject arbitrary code.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.