Hugo is a static site generator. Starting in version 0.123.0 and prior to version 0.139.4, some HTML attributes in Markdown in the internal templates listed below not escaped in internal render hooks. Those whoa re impacted are Hugo users who do not trust their Markdown content files and are using one or more of these templates: `_default/_markup/render-link.html` from `v0.123.0`; `_default/_markup/render-image.html` from `v0.123.0`; `_default/_markup/render-table.html` from `v0.134.0`; and/or `shortcodes/youtube.html` from `v0.125.0`. This issue is patched in v0.139.4. As a workaround, one may replace an affected component with user defined templates or disable the internal templates.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Hugo is a static site generator. Starting in version 0.123.0 and prior to version 0.139.4, some HTML     attributes in Markdown in the internal templates listed below not escaped in internal render hooks. Those     whoa re impacted are Hugo users who do not trust their Markdown content files and are using one or more of     these templates: `_default/_markup/render-link.html` from `v0.123.0`; `_default/_markup/render-image.html`     from `v0.123.0`; `_default/_markup/render-table.html` from `v0.134.0`; and/or `shortcodes/youtube.html`     from `v0.125.0`. This issue is patched in v0.139.4. As a workaround, one may replace an affected component     with user defined templates or disable the internal templates. (CVE-2024-55601)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Hugo is a static site generator. Starting in version 0.123.0 and prior to version 0.139.4, some HTML
    attributes in Markdown in the internal templates listed below not escaped in internal render hooks. Those
    whoa re impacted are Hugo users who do not trust their Markdown content files and are using one or more of
    these templates: `_default/_markup/render-link.html` from `v0.123.0`; `_default/_markup/render-image.html`
    from `v0.123.0`; `_default/_markup/render-table.html` from `v0.134.0`; and/or `shortcodes/youtube.html`
    from `v0.125.0`. This issue is patched in v0.139.4. As a workaround, one may replace an affected component
    with user defined templates or disable the internal templates. (CVE-2024-55601)

ID	Name	Product	Family	Severity
248380	Linux Distros Unpatched Vulnerability : CVE-2024-55601	Nessus	Misc.	medium
427788	Alpine: multiple hugo packages: security update to 0.140.1-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	medium
427788	Alpine: multiple hugo packages: security update to 0.140.1-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	medium
413599	SCA: security update for github.com/gohugoio/hugo (GHSA-c2xf-9v2r-r2rx)	Tenable Cloud Security	SCA Checks	medium
413599	SCA: security update for github.com/gohugoio/hugo (GHSA-c2xf-9v2r-r2rx)	Tenable Self-Hosted Container Security	SCA Checks	medium

Detections

Analytics

CVE-2024-55601

medium

Tenable Plugins

medium

medium

medium

medium

medium