CVE-2021-25987

Hexo - Stored XSS

State: Published
Severity: 5.0 Medium
Published: Nov 30, 2021
Updated: Apr 30, 2025
Reserved: Jan 22, 2021

Description

Hexo versions 0.0.1 to 5.4.0 are vulnerable against stored XSS. The post “body” and “tags” don’t sanitize malicious javascript during web page generation. Local unprivileged attacker can inject arbitrary code.

Scores

CVSS	Score	Vector	Source
3.1	5.0 Medium	CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N	Mend

Weaknesses

CWE-79 Cross-site Scripting (XSS)

Affected Products

Product	Versions
HexoHexo	5.4.0 and earlierAffected next of 0.0.1 to before unspecifiedAffected

References

https://github.com/hexojs/hexo/commit/5170df2d3fa9c69e855c4b7c2b084ebfd92d5200
https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25987

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.