CVE-2021-25987: Hexo

Medium severity, CVSS 4.6. EPSS: 0.3% chance of exploitation in the next 30 days.

Hexo versions 0.0.1 to 5.4.0 are vulnerable against stored XSS. The post “body” and “tags” don’t sanitize malicious javascript during web page generation. Local unprivileged attacker can inject arbitrary code.

Affected products

• Hexo Hexo: from 0.0.1, up to and including 5.4.0

Published 2021-11-30. Last modified 2026-06-17.