CVE-2024-32875

Hugo is a static site generator. Starting in version 0.123.0 and prior to version 0.125.3, title arguments in Markdown for links and images not escaped in internal render hooks. Hugo users who are impacted are those who have these hooks enabled and do not trust their Markdown content files. The issue is patched in v0.125.3. As a workaround, replace the templates with user defined templates or disable the internal templates.

• CWE-79
• CWE-80

• https://github.com/gohugoio/hugo/releases/tag/v0.125.3
• https://github.com/gohugoio/hugo/security/advisories/GHSA-ppf8-hhpp-f5hj
• https://gohugo.io/getting-started/configuration-markup/#renderhooksimageenabledefault
• https://github.com/gohugoio/hugo/releases/tag/v0.125.3
• https://github.com/gohugoio/hugo/security/advisories/GHSA-ppf8-hhpp-f5hj
• https://gohugo.io/getting-started/configuration-markup/#renderhooksimageenabledefault

Published

Apr 23, 2024

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-3287The SmartCrawl WordPress SEO checker, SEO analyzer, SEO opti…5.3
• CVE-2024-32870Combodo iTop is a simple, web based IT Service Management to…5.8
• CVE-2024-32871Pimcore is an Open Source Data & Experience Management Platf…7.5
• CVE-2024-32872Umbraco workflow provides workflows for the Umbraco content …5.5
• CVE-2024-32873Evmos is the Ethereum Virtual Machine (EVM) Hub on the Cosmo…4.3
• CVE-2024-32874Frigate is a network video recorder (NVR) with realtime loca…6.8
• CVE-2024-32876NewPipe is an Android app for video streaming written in Jav…8.5
• CVE-2024-32877Yii 2 is a PHP application framework. During internal penetr…4.7
• CVE-2024-32878Llama.cpp is LLM inference in C/C++. There is a use of unini…8.8
• CVE-2024-32879Python Social Auth is a social authentication/registration m…4.9
• CVE-2024-3288The Logo Slider WordPress plugin before 4.0.0 does not vali…5.4
• CVE-2024-32880pyload is an open-source Download Manager written in pure Py…7.2