CVE-2021-25987

CVE-2021-25987 affects Hexo up to 5.4.0, where stored XSS is possible due to lack of sanitization in the post body and tags during page generation. An unprivileged local attacker can inject arbitrary JavaScript that executes in the victim’s browser. The vulnerability is documented across multiple...