{"action":"Upgrade github.com/gohugoio/hugo to 0.125.3 or later.","affected":[{"fixed":"0.125.3","introduced":"0.123.0"}],"component":"github.com/gohugoio/hugo","cve_ids":["CVE-2024-32875"],"ecosystem":"Go","epss":0.00537,"exploited":false,"fixed_versions":["0.125.3"],"ghsa_id":"GHSA-ppf8-hhpp-f5hj","id":"tcs_01M5KG2P7FMN5HQA5X2RC1HQ5M","modified_at":"2026-02-04T02:40:25.539330Z","published_at":"2024-06-04T15:19:21Z","references":["https://osv.dev/vulnerability/GO-2024-2747","https://github.com/gohugoio/hugo/security/advisories/GHSA-ppf8-hhpp-f5hj","https://github.com/gohugoio/hugo/commit/15a4b9b33715887001f6eff30721d41c0d4cfdd1","https://github.com/gohugoio/hugo/releases/tag/v0.125.3","https://gohugo.io/getting-started/configuration-markup/#renderhooksimageenabledefault"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"GO-2024-2747","url":"https://osv.dev/vulnerability/GO-2024-2747"}],"summary":"Hugo Markdown titles are not escaped in internal render hooks in github.com/gohugoio/hugo"}