Homepage

hexo@0.4.3 vulnerabilities

A fast, simple & powerful blog framework, powered by Node.js.

  • latest version

    7.3.0

  • latest non vulnerable version

    7.3.0

  • first published

    12 years ago

  • latest version published

    5 months ago

  • licenses detected

  • View hexo package health on Snyk Advisor  (opens in a new tab)
    • Go back to all versions of this package
    Report a new vulnerability Found a mistake?

    Direct Vulnerabilities

    Known vulnerabilities in the hexo package. This does not include vulnerabilities belonging to this package’s dependencies.

    How to fix?

    Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.

    Fix for free
    VulnerabilityVulnerable Version
    • H
    Directory Traversal

    hexo is an A fast, simple & powerful blog framework, powered by Node.js.

    Affected versions of this package are vulnerable to Directory Traversal via the Hexo's file read functionality. An attacker can read arbitrary files by manipulating the file path input.

    Note:

    This issue is only exploitable if the attacker has the ability to control the file path input. This vulnerability was only verified successfully in the Windows environment.

    How to fix Directory Traversal?

    Upgrade hexo to version 7.2.0 or higher.

    <7.2.0
    • M
    Cross-site Scripting (XSS)

    hexo is an A fast, simple & powerful blog framework, powered by Node.js.

    Affected versions of this package are vulnerable to Cross-site Scripting (XSS). The POST body and tags don't sanitize malicious javascript during web page generation. As a result, local unprivileged attacker could inject arbitrary code.

    How to fix Cross-site Scripting (XSS)?

    Upgrade hexo to version 6.0.0 or higher.

    <6.0.0
    Go back to all versions of this package