HighCVSS 7.5
EPSS 34.5%
Hexo up to v7.0.0 (RC2) was discovered to contain an arbitrary file read vulnerability.
Product
npm hexo vulnerabilities
2 published CVES affecting npm hexo, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).
- Total
- 2
- Critical
- 0
- High
- 1
- Medium
- 1
- Low
- 0
- Unscored
- 0
- CISA KEV
- 0
Latest npm hexo CVEs
Newest publication first
-
-
CVE-2021-25987 Hexo - Stored XSS
PublishedMediumCVSS 4.6 EPSS 0.34%Hexo versions 0.0.1 to 5.4.0 are vulnerable against stored XSS. The post “body” and “tags” don’t sanitize malicious javascript during web page generation. Local unprivileged attacker can inject arbitrary code.
Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.