hexo-theme-shokax (>=0.3.12, <=0.4.2) potentially affected by CVE-2023-39584 via hexo (7.0.0)

hexo NPM version 7.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on hexo and may be impacted: - hexo-theme-shokax =0.3.12, =0.4.2 Source cves: CVE-2023-39584 Source advisory: OSV:GHSA-X2JC-989C-47Q4...

CVE-2023-39584

Hexo up to v7.0.0 RC2 was discovered to contain an arbitrary file read vulnerability...

CVE-2023-39584

Hexo up to v7.0.0 RC2 was discovered to contain an arbitrary file read vulnerability...

CVE-2023-39584

Hexo up to v7.0.0 RC2 was discovered to contain an arbitrary file read vulnerability...

CVE-2023-39584

CVE-2023-39584 (Hexo) affects Hexo up to 7.0.0 RC2. The issue is an arbitrary file read caused by a flawed file read/path handling in the include_code functionality, enabling reading arbitrary files. Impact is potential sensitive data disclosure. Remediation: upgrade to a version later than 7.0.0...