title: Hexo - Stored XSS
description: Hexo versions 0.0.1 to 5.4.0 are vulnerable against stored XSS. The post “body” and “tags” don’t sanitize malicious javascript during web page generation. Local unprivileged attacker can inject arbitrary code.
problem types: CWE-79 Cross-site Scripting (XSS)
affected:
{
product: Hexo
vendor: Hexo
versions:
lessThanOrEqual: 5.4.0, status: affected, version: unspecified, versionType: custom
lessThan: unspecified, status: affected, version: next of 0.0.1, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 5
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
version: 3.1
]