Executive brief
Hexo is a static site generator that converts blog posts and content into HTML pages. Versions up to 5.4.0 fail to sanitize JavaScript code in post content and tags, allowing anyone with write access to the source to inject malicious scripts that execute when the site is generated. An attacker who gains access to a server hosting Hexo source code or a web-based editor could inject persistent XSS payloads.
Technical details
This is a stored XSS vulnerability (CWE-79) in Hexo's HTML generation engine affecting versions 0.0.1 through 5.4.0. The vulnerability exists because post "body" and "tags" fields are not sanitized during static page generation, allowing arbitrary JavaScript injection. Attack requires local or server-level write access to blog posts or a compromised web editor (such as hexo-editor); the XSS executes when readers view the generated HTML pages. The Hexo team clarified this is technically a self-XSS requiring pre-compromise of the content source, not a reflected or stored XSS via normal user interaction. The fix (HTML entity escaping by default) was implemented in PR #4743 five months prior to disclosure and is included in Hexo 6.0.0 as a breaking change.
Affected products
- Hexo Hexo 0.0.1 to 5.4.0
Timeline
- 2021-11-30: disclosed: NVD published
- 2021-12-01: advisory: GHSA published
- 2021-12-14: patched: Fix included in Hexo 6.0.0
- 2021-09: other: Fix implemented in PR #4743, approximately 5 months before disclosure