Medium severity5.0NVD Advisory· Published Nov 30, 2021· Updated Jun 17, 2026

CVE-2021-25987

Description

Hexo versions 0.0.1 to 5.4.0 are vulnerable against stored XSS. The post “body” and “tags” don’t sanitize malicious javascript during web page generation. Local unprivileged attacker can inject arbitrary code.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
hexonpm	>= 0.0.1, < 6.0.0	6.0.0

Affected products

ghsa-coords
pkg:npm/hexo
Range: >= 0.0.1, < 6.0.0
Hexo/Hexo2 versions
cpe:2.3:a:hexo:hexo:*:*:*:*:*:node.js:*:*+ 1 more
- cpe:2.3:a:hexo:hexo:*:*:*:*:*:node.js:*:*range: >=0.0.1,<=5.4.0
- (no CPE)range: unspecified

Patches

Vulnerability mechanics

References

github.com/hexojs/hexo/commit/5170df2d3fa9c69e855c4b7c2b084ebfd92d5200nvdPatchThird Party AdvisoryWEB
github.com/advisories/GHSA-q54r-r9pr-w7qvghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2021-25987ghsaADVISORY
www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25987nvdThird Party AdvisoryWEB
github.com/hexojs/hexo/issues/4838ghsaWEB
github.com/hexojs/hexo/pull/4750ghsaWEB

News mentions

No linked articles in our index yet.

cvss	0.325
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000