VULNERABILITY INTELLIGENCE

CVE-2021-25987

CVSS score5 MEDIUM

EPSS probability0.34%

CISA KEVNot currently listed

Published2021-11-30

Last modified2026-06-17

CVSS vectorCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Description

Hexo versions 0.0.1 to 5.4.0 are vulnerable against stored XSS. The post “body” and “tags” don’t sanitize malicious javascript during web page generation. Local unprivileged attacker can inject arbitrary code.

Weakness classification

vulnerabilitylab@mend.io: CWE-79
nvd@nist.gov: CWE-79

Primary references

vulnerabilitylab@mend.io — Patch, Third Party Advisory
vulnerabilitylab@mend.io — Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Patch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Third Party Advisory