CVE-2023-39584

Description

Hexo up to v7.1.1 was discovered to contain an arbitrary file read vulnerability.

How to fix CVE-2023-39584

To remediate CVE-2023-39584, upgrade the affected package to a fixed version below.

• npm/hexo—upgrade to 7.2.0 or later

Is CVE-2023-39584 being exploited?

Low — EPSS is 4.7%, meaning exploitation activity has not been observed at scale.

Affected packages (1)

• from 0, < 7.2.0

CVSS scores

References (7)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2023-39584
• PATCHgithub.com/hexojs/hexo
• WEBgithub.com/hexojs/hexo/blob/a3e68e7576d279db22bd7481914286104e867834/lib/plugins/tag/include_code.js#L49
• WEBgithub.com/hexojs/hexo/blob/cefee921153ba597316457f4fedf7b87b6516917/lib/plugins/tag/include_code.ts#L50