Executive brief
hexo-admin is a web-based administrative interface for the Hexo static site generator. The package fails to properly sanitize user-supplied markdown in the post editor, allowing attackers to inject and execute malicious JavaScript code in the browsers of users who view the compromised posts, potentially leading to session hijacking, credential theft, or unauthorized actions.
Technical details
The vulnerability is a stored/reflected cross-site scripting (XSS) flaw in the post editor component, arising from insufficient sanitization of markdown content before rendering. An attacker with the ability to create or edit posts can inject arbitrary HTML and JavaScript payloads (e.g., <img src=x onerror=alert("XSS")>) that execute in the browser of any user viewing the post. The attack vector requires post creation privileges but does not require authentication bypass; once injected, the payload persists and affects all viewers. No patch is currently available as of the advisory publication date (September 2020).
Affected products
- hexo-admin contributors hexo-admin all versions
Timeline
- 2020-09-03: disclosed: Advisory published