CVE-2021-25987

Published November 30th, 2021

View on NVD ↗

CVSS v3

MEDIUM

CVSS v2

1.9

LOW

Affected

PROJECT

Description

Hexo versions 0.0.1 to 5.4.0 are vulnerable against stored XSS. The post “body” and “tags” don’t sanitize malicious javascript during web page generation. Local unprivileged attacker can inject arbitrary code.

hexojs/hexo

A fast, simple & powerful blog framework, powered by Node.js.

GitHub

41.8K