x/vulndb: potential Go vuln in github.com/gohugoio/hugo: CVE-2024-55601

[GoVulnBot]

Advisory CVE-2024-55601 references a vulnerability in the following Go modules:

Module
github.com/gohugoio/hugo

Description:
Hugo is a static site generator. Starting in version 0.123.0 and prior to version 0.139.4, some HTML attributes in Markdown in the internal templates listed below not escaped in internal render hooks. Those whoa re impacted are Hugo users who do not trust their Markdown content files and are using one or more of these templates: _default/_markup/render-link.html from v0.123.0; _default/_markup/render-image.html from v0.123.0; _default/_markup/render-table.html from v0.134.0; and/or shortcodes/youtube.html from v0.125.0. This issue is patched in v0.139.4. As a workaround, one ma...

References:

• ADVISORY: https://nvd.nist.gov/vuln/detail/CVE-2024-55601
• FIX: gohugoio/hugo@54398f8
• WEB: https://github.com/gohugoio/hugo/releases/tag/v0.139.4
• WEB: GHSA-c2xf-9v2r-r2rx
• WEB: https://gohugo.io/getting-started/configuration-markup/#renderhooksimageenabledefault

Cross references:

• github.com/gohugoio/hugo appears in 2 other report(s):
  • data/excluded/GO-2022-0764.yaml (x/vulndb: potential Go vuln in github.com/gohugoio/hugo: GHSA-8j34-9876-pvfq #764) DEPENDENT_VULNERABILITY
  • data/reports/GO-2024-2747.yaml (x/vulndb: potential Go vuln in github.com/gohugoio/hugo: CVE-2024-32875 #2747)

See doc/quickstart.md for instructions on how to triage this report.

id: GO-ID-PENDING
modules:
    - module: github.com/gohugoio/hugo
      vulnerable_at: 0.139.3
summary: CVE-2024-55601 in github.com/gohugoio/hugo
cves:
    - CVE-2024-55601
references:
    - advisory: https://nvd.nist.gov/vuln/detail/CVE-2024-55601
    - fix: https://github.com/gohugoio/hugo/commit/54398f8d572c689f9785d59e907fd910a23401b0
    - web: https://github.com/gohugoio/hugo/releases/tag/v0.139.4
    - web: https://github.com/gohugoio/hugo/security/advisories/GHSA-c2xf-9v2r-r2rx
    - web: https://gohugo.io/getting-started/configuration-markup/#renderhooksimageenabledefault
source:
    id: CVE-2024-55601
    created: 2024-12-09T23:01:25.011231482Z
review_status: UNREVIEWED

[tatianab]

Duplicate of #3314