CVE-2021-25987

    Dashboard / Vulnerabilities / CVE-2021-25987

    CVE-2021-25987

    Published: 30 Nov 2021Last Modified: 8 Jul 2026

    Summary:

    Details: Hexo versions 0.0.1 to 5.4.0 are vulnerable against stored XSS. The post “body” and “tags” don’t sanitize malicious javascript during web page generation. Local unprivileged attacker can inject arbitrary code.

    References: https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25987, https://github.com/hexojs/hexo/commit/5170df2d3fa9c69e855c4b7c2b084ebfd92d5200

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 3fdc19bcaaebe7b84d615490c0c87b371331e127
    Fixed -None

    Affected versions

    5.4.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2021-25987 | CVE-DB