{"cve":"CVE-2024-32875","nvd":{"published":"2024-04-23T21:15:48.837","modified":"2026-06-17T07:30:35.933","status":"Deferred","description":"Hugo is a static site generator. Starting in version 0.123.0 and prior to version 0.125.3, title arguments in Markdown for links and images not escaped in internal render hooks. Hugo users who are impacted are those who have these hooks enabled and do not trust their Markdown content files. The issue is patched in v0.125.3. As a workaround, replace the templates with user defined templates or disable the internal templates.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","score":6.1},"cwes":["CWE-79","CWE-80"],"references":["https://github.com/gohugoio/hugo/releases/tag/v0.125.3","https://github.com/gohugoio/hugo/security/advisories/GHSA-ppf8-hhpp-f5hj","https://gohugo.io/getting-started/configuration-markup/#renderhooksimageenabledefault","https://github.com/gohugoio/hugo/releases/tag/v0.125.3","https://github.com/gohugoio/hugo/security/advisories/GHSA-ppf8-hhpp-f5hj"],"products":[],"source":"nvd","synced_at":"2026-10-19T21:49:08.435428910+00:00"},"epss":{"cve":"CVE-2024-32875","score":0.00537,"percentile":0.45258,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-ppf8-hhpp-f5hj","url":"https://osv.dev/vulnerability/GHSA-ppf8-hhpp-f5hj","summary":"Hugo Markdown titles do not escaped in internal render hooks","modified":"2026-09-10T03:50:11.361864953Z","packages":[{"ecosystem":"Go","name":"github.com/gohugoio/hugo","purl":"pkg:golang/github.com/gohugoio/hugo","ranges":[">=0.123.0 <0.125.3"],"fixed":["0.125.3"]}]},{"id":"GO-2024-2747","url":"https://osv.dev/vulnerability/GO-2024-2747","summary":"Hugo Markdown titles are not escaped in internal render hooks in github.com/gohugoio/hugo","modified":"2026-02-04T02:40:25.539330Z","packages":[{"ecosystem":"Go","name":"github.com/gohugoio/hugo","purl":"pkg:golang/github.com/gohugoio/hugo","ranges":[">=0.123.0 <0.125.3"],"fixed":["0.125.3"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}