@dpu/hexo-github-include (>=0.0.1 <=0.0.2), @exabugs/hexo-theme-icarus (=5.1.0) +114 more potentially affected by CVE-2023-39584 via hexo (>=2.4.5 <=7.0.0)

hexo NPM version =2.4.5, =0.0.1, =1.0.0, =1.4.0, =1.0.2, =22.8.141, =1.0.0, =1.0.0, =1.0.11, =1.0.16, =1.0.17 - diangua-test-hexo-site =0.0.0 and more Source cves: CVE-2023-39584 Source advisory: OSV:GHSA-X2JC-989C-47Q4...

CVE-2023-39584

Hexo up to v7.0.0 RC2 was discovered to contain an arbitrary file read vulnerability...

CVE-2023-39584

Hexo up to v7.0.0 RC2 was discovered to contain an arbitrary file read vulnerability...

CVE-2023-39584

CVE-2023-39584 (Hexo) affects Hexo up to 7.0.0 RC2. The issue is an arbitrary file read caused by a flawed file read/path handling in the include_code functionality, enabling reading arbitrary files. Impact is potential sensitive data disclosure. Remediation: upgrade to a version later than 7.0.0...

CVE-2023-39584

Hexo up to v7.0.0 RC2 was discovered to contain an arbitrary file read vulnerability...