—
GO-2024-3314
Hugo does not escape some attributes in internal templates in github.com/gohugoio/hugo
Quick fix
GO-2024-3314 — github.com/gohugoio/hugo: upgrade to the fixed version with the command below.
go get github.com/gohugoio/hugo@v0.139.4Details
Hugo does not escape some attributes in internal templates in github.com/gohugoio/hugo
Are you affected?
Enter the version of the package you're using.
Affected packages
Go/github.com/gohugoio/hugo
Introduced in:
0.123.0Fixed in: 0.139.4Fix
go get github.com/gohugoio/hugo@v0.139.4References
- https://github.com/gohugoio/hugo/security/advisories/GHSA-c2xf-9v2r-r2rx[ADVISORY]
- https://github.com/gohugoio/hugo/commit/54398f8d572c689f9785d59e907fd910a23401b0[FIX]
- https://github.com/gohugoio/hugo/releases/tag/v0.139.4[WEB]
- https://gohugo.io/getting-started/configuration-markup/#renderhooksimageenabledefault[WEB]