What is CVE-2021-25987?

CVE-2021-25987 is a medium-severity vulnerability in Hexo, classified under Cross-site Scripting. CVSS score: 5.0/10. Published 2021-11-30.

How severe is CVE-2021-25987?

Medium severity. CVSS v3 base score is 5.0 out of 10.

XSS in Hexo

CVE-2021-25987

Hexo versions 0.0.1 to 5.4.0 are vulnerable against stored XSS. The post “body” and “tags” don’t sanitize malicious javascript during web page generation. Local unprivileged attacker can inject arbitrary code.

Vulnerability class: XSS (Cross-Site Scripting)

EPSS: 0.003 (25.3th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 5.0 (Medium). Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N.

Affected products

Hexo — versions unspecified, next of 0.0.1

Weakness classification (CWE)

CWE-79 — Cross-site Scripting

References

vulnerabilitylab@mend.io (Patch, Third Party Advisory, x_refsource_MISC)
vulnerabilitylab@mend.io (Third Party Advisory, x_refsource_MISC)

Frequently asked questions

What is CVE-2021-25987?: CVE-2021-25987 is a medium-severity vulnerability in Hexo, classified under Cross-site Scripting. CVSS score: 5.0/10. Published 2021-11-30.
How severe is CVE-2021-25987?: Medium severity. CVSS v3 base score is 5.0 out of 10.