{"action":"Upgrade hexo to 7.2.0 or later.","affected":[{"fixed":"7.2.0","introduced":"0"}],"component":"hexo","cve_ids":["CVE-2023-39584"],"ecosystem":"npm","epss":0.34538,"exploited":false,"fixed_versions":["7.2.0"],"ghsa_id":"GHSA-x2jc-989c-47q4","id":"tcs_01M5KGGH0E1A8P9V8YQ95JPBNN","modified_at":"2025-09-05T13:29:14Z","published_at":"2023-09-08T15:30:18Z","references":["https://osv.dev/vulnerability/GHSA-x2jc-989c-47q4","https://nvd.nist.gov/vuln/detail/CVE-2023-39584","https://github.com/hexojs/hexo/issues/5250","https://github.com/hexojs/hexo/pull/5251","https://github.com/hexojs/hexo/commit/b5b63caee27256d71a0cee8954c22375ec885d07","https://github.com/hexojs/hexo","https://github.com/hexojs/hexo/blob/a3e68e7576d279db22bd7481914286104e867834/lib/plugins/tag/include_code.js#L49","https://github.com/hexojs/hexo/blob/cefee921153ba597316457f4fedf7b87b6516917/lib/plugins/tag/include_code.ts#L50"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"GHSA-x2jc-989c-47q4","url":"https://osv.dev/vulnerability/GHSA-x2jc-989c-47q4"}],"summary":"Hexo `include_code` has a path traversal"}