CVE-2024-32875

Summary

CVE-2024-32875 affects versions 0.123.0 to 0.125.2 of Hugo, a popular static site generator. The vulnerability lies in the lack of escaping for title arguments in Markdown for links and images within internal render hooks. This issue poses a risk to Hugo users who have these hooks enabled and do not thoroughly trust their Markdown content files. The vulnerability has been resolved in version 0.125.3. As a temporary measure, users can replace the templates with their own or disable the internal templates to mitigate the risk.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.