CVE-2024-32875

What it actually does

Unescaped title arguments from Markdown links and images are rendered directly in internal render hooks, enabling cross-site scripting when untrusted Markdown is processed.

Why it matters to the business

Organizations using affected Hugo versions to generate public sites risk script injection from Markdown sources, which can lead to defacement, credential theft from visitors, or unauthorized actions within the rendered site context; urgency is low given stable low EPSS and no known exploitation campaigns.

How an attack unfolds

An attacker supplies Markdown content containing a link or image whose title attribute includes a script payload; when Hugo's internal render hooks process the file without escaping, the payload is emitted verbatim into the generated HTML and executes in visitors' browsers.

How to fix it

Upgrade gohugoio/hugo to the fixed commit 474c4c02212cf97712c6fbf4159c68822ea6e078 (version 0.125.3 or later). As a temporary measure, replace the affected internal templates with custom ones or disable the internal render hooks entirely.

How to confirm the fix worked

Confirm the installed Hugo binary reports version 0.125.3 or newer; render a test Markdown file containing a link with a title attribute set to a benign script tag and verify the output HTML contains the escaped or absent payload.

Typical attack path

1. Identify a Hugo site using internal render hooks and accepting untrusted Markdown input
2. Craft a Markdown link or image whose title attribute contains a JavaScript payload
3. Submit or commit the malicious Markdown to the content source
4. Trigger a site rebuild so the rendered HTML includes the unescaped payload
5. Wait for a visitor to load the page and execute the injected script

How to detect it

Review generated site HTML for unescaped title attributes containing script tags or event handlers; inspect build logs and content repositories for recent Markdown files with suspicious link or image syntax; monitor visitor browser reports or CSP violation logs for unexpected script execution originating from rendered pages.

What your security team should do

• Immediately upgrade all Hugo installations to the patched commit or newer release
• Audit Markdown content sources to ensure only trusted authors can supply files
• Replace internal render hooks with custom templates that properly escape title attributes
• Add automated build-time scanning of generated HTML for unescaped script patterns