CVE-2023-39584

Hexo `include_code` has a path traversal

7.5 HighFix available

Hexo up to v7.0.0 (RC2) was discovered to contain an arbitrary file read vulnerability.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: None
Availability: None

Exploit likelihood

34.5%Up 34.5 points since Sep 9, 2023

What each source reports

NVD Score used 7.5

Hexo up to v7.0.0 (RC2) was discovered to contain an arbitrary file read vulnerability.

Record: CVE-2023-39584
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness: CWE-22
Updated: 2026-11-02

CVE List No score

Hexo up to v7.0.0 (RC2) was discovered to contain an arbitrary file read vulnerability.

Record: CVE-2023-39584
Weakness: CWE-22
Updated: 2026-11-02

EUVDEUVD-2023-43293 No score

Hexo up to v7.0.0 (RC2) was discovered to contain an arbitrary file read vulnerability.

Record: EUVD-2023-43293
Updated: 2026-11-03

GitHub AdvisoriesGHSA-x2jc-989c-47q4 7.5

Hexo `include_code` has a path traversal

Hexo up to v7.1.1 was discovered to contain an arbitrary file read vulnerability.

Record: GHSA-x2jc-989c-47q4
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness: CWE-22
Updated: 2026-11-02

OSVGHSA-x2jc-989c-47q4 7.5

Hexo `include_code` has a path traversal

Hexo up to v7.1.1 was discovered to contain an arbitrary file read vulnerability.

Record: GHSA-x2jc-989c-47q4
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness: CWE-22
Updated: 2026-11-02

OSV No score

Hexo up to v7.0.0 (RC2) was discovered to contain an arbitrary file read vulnerability.

Record: CVE-2023-39584
Updated: 2026-11-02

Affected products

hexo

Affected packages

Affected packages
Package	Affected	Fixed
`hexo` npm	before 7.2.0	7.2.0

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2023-39584 is a high vulnerability (CVSS 7.5) in Hexo, published September 8, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 34.5%, the 98th percentile. Fixed in hexo 7.2.0.

References

Show 4 moreShow less