CVE-2024-32875
Hugo doesn't escape markdown title in internal render hooks
Hugo is a static site generator. Starting in version 0.123.0 and prior to version 0.125.3, title arguments in Markdown for links and images not escaped in internal render hooks. Hugo users who are impacted are those who have these hooks enabled and do not trust their Markdown content files. The issue is patched in v0.125.3. As a workaround, replace the templates with user defined templates or disable the internal templates.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Hugo doesn't escape markdown title in internal render hooks
Hugo is a static site generator. Starting in version 0.123.0 and prior to version 0.125.3, title arguments in Markdown for links and images not escaped in internal render hooks. Hugo users who are impacted are those who have these hooks enabled and do not trust their Markdown content files. The issue is patched in v0.125.3. As a workaround, replace the templates with user defined templates or disable the internal templates.
- Record
CVE-2024-32875- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-80, CWE-79
- Updated
- 2026-11-02
EUVDEUVD-2024-1268
Hugo is a static site generator. Starting in version 0.123.0 and prior to version 0.125.3, title arguments in Markdown for links and images not escaped in internal render hooks. Hugo users who are impacted are those who have these hooks enabled and do not trust their Markdown content files. The issue is patched in v0.125.3. As a workaround, replace the templates with user defined templates or disable the internal templates.
- Record
EUVD-2024-1268- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-ppf8-hhpp-f5hj
Hugo Markdown titles do not escaped in internal render hooks
Impact
Title argument in Markdown for links and images not escaped in internal render hooks. Impacted are Hugo users who have these hooks enabled and do not trust their Markdown content files.
Patches
Patched in v0.125.3.
Workarounds
Replace with user defined templates or disable the internal templates: https://gohugo.io/getting-started/configuration-markup/#renderhooksimageenabledefault
References
- Record
GHSA-ppf8-hhpp-f5hj- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
NVD
Hugo is a static site generator. Starting in version 0.123.0 and prior to version 0.125.3, title arguments in Markdown for links and images not escaped in internal render hooks. Hugo users who are impacted are those who have these hooks enabled and do not trust their Markdown content files. The issue is patched in v0.125.3. As a workaround, replace the templates with user defined templates or disable the internal templates.
- Record
CVE-2024-32875- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79, CWE-80
- Updated
- 2026-11-02
OSV
Hugo doesn't escape markdown title in internal render hooks
Hugo is a static site generator. Starting in version 0.123.0 and prior to version 0.125.3, title arguments in Markdown for links and images not escaped in internal render hooks. Hugo users who are impacted are those who have these hooks enabled and do not trust their Markdown content files. The issue is patched in v0.125.3. As a workaround, replace the templates with user defined templates or disable the internal templates.
- Record
CVE-2024-32875- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79, CWE-80
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2024-32875
Hugo is a static site generator. Starting in version 0.123.0 and prior to version 0.125.3, title arguments in Markdown for links and images not escaped in internal render hooks. Hugo users who are impacted are those who have these hooks enabled and do not trust their Markdown content files. The issue is patched in v0.125.3. As a workaround, replace the templates with user defined templates or disable the internal templates.
- Record
DEBIAN-CVE-2024-32875- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
OSVGHSA-ppf8-hhpp-f5hj
Hugo Markdown titles do not escaped in internal render hooks
Impact
Title argument in Markdown for links and images not escaped in internal render hooks. Impacted are Hugo users who have these hooks enabled and do not trust their Markdown content files.
Patches
Patched in v0.125.3.
Workarounds
Replace with user defined templates or disable the internal templates: https://gohugo.io/getting-started/configuration-markup/#renderhooksimageenabledefault
References
- Record
GHSA-ppf8-hhpp-f5hj- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2024-32875
Hugo is a static site generator. Starting in version 0.123.0 and prior to version 0.125.3, title arguments in Markdown for links and images not escaped in internal render hooks. Hugo users who are impacted are those who have these hooks enabled and do not trust their Markdown content files. The issue is patched in v0.125.3. As a workaround, replace the templates with user defined templates or disable the internal templates.
- Record
UBUNTU-CVE-2024-32875- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
OSVGO-2024-2747 No score
Hugo Markdown titles are not escaped in internal render hooks in github.com/gohugoio/hugo
Hugo Markdown titles are not escaped in internal render hooks in github.com/gohugoio/hugo
- Record
GO-2024-2747- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
github.com/gohugoio/hugoGo |
0.123.0 up to 0.125.3 | 0.125.3 |
hugoDebian:13 |
before 0.125.4-1 | 0.125.4-1 |
hugoDebian:14 |
before 0.125.4-1 | 0.125.4-1 |
hugoUbuntu:16.04:LTS |
All versions, plus listed versions 0.15+git20160109.147.dd1d655-10.15+git20160109.147.dd1d655-20.15+git20160128.179.5def6d9-10.15+git20160206.203.ed23711-1 |
None known |
hugoUbuntu:18.04:LTS |
All versions, plus listed versions 0.25.1-20.26-10.35-10.37.1-10.38-10.39-10.40-10.40.1-1 |
None known |
hugoUbuntu:20.04:LTS |
All versions, plus listed versions 0.57.2-10.58.3-10.59.1-1.10.68.3-1 |
None known |
hugoUbuntu:22.04:LTS |
All versions, plus listed versions 0.80.0-60.89.4-20.90.0-10.90.1-10.91.0-1 Show 5 moreShow less0.91.2-10.92.0-10.92.1-1build10.92.2-10.92.2-1ubuntu0.1 |
None known |
hugoUbuntu:Pro:24.04:LTS |
All versions, plus listed versions 0.113.0-30.119.0-20.120.3-10.120.4-10.121.2-1 Show 8 moreShow less0.122.0-10.123.7-1build10.123.7-1ubuntu0.10.123.7-1ubuntu0.20.123.7-1ubuntu0.2+esm10.123.7-1ubuntu0.30.123.7-1ubuntu0.3+esm10.123.7-1ubuntu0.3+esm2 |
None known |
hugoUbuntu:25.10 |
All versions, plus listed versions 0.131.0-1 |
None known |
hugoUbuntu:26.10 |
All versions, plus listed versions 0.154.5-10.162.1-50.162.1-7 |
None known |
hugoUbuntu:26.04:LTS |
All versions, plus listed versions 0.131.0-10.152.2-10.153.1-30.153.2-10.154.2-20.154.3-10.154.5-1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-32875 is a medium vulnerability (CVSS 6.1) in Gohugo Hugo, published April 23, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.54%, the 45th percentile. Fixed in github.com/gohugoio/hugo 0.125.3.