CVE-2024-32875: 
Wolfi vulnerability analysis and mitigation

Hugo, a static site generator, introduced a security vulnerability in version 0.123.0 that persisted until version 0.125.3. The vulnerability involves title arguments in Markdown for links and images not being properly escaped in internal render hooks (GitHub Advisory, NVD).

The vulnerability has been assigned CVE-2024-32875 and received a CVSS v3.1 Base Score of 6.1 (Medium). It is classified under CWE-80 (Improper Neutralization of Script-Related HTML Tags in a Web Page) and CWE-79 (Cross-site Scripting). The issue specifically affects the internal render hooks functionality when processing title arguments in Markdown for links and images (GitHub Advisory).

The vulnerability impacts Hugo users who have internal render hooks enabled and do not trust their Markdown content files. This could potentially lead to Cross-site Scripting (XSS) attacks if exploited (GitHub Advisory).

The vulnerability requires an attacker to have the ability to modify Markdown content files in a Hugo site that has internal render hooks enabled. The attack vector is network-based with low attack complexity, requiring user interaction (NVD).

The vulnerability has been patched in Hugo version 0.125.3. For users unable to upgrade immediately, two workarounds are available: replace the templates with user-defined templates or disable the internal templates. These configuration changes can be made in the markup settings (Hugo Docs, GitHub Release).