Unrated
Security advisory
Hexo up to v7.0.0 (RC2) was discovered to contain an arbitrary file read vulnerability.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2023-39584
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 5 Nov 2026, 05:44 UTC · Revision 1
Source evidence
Hexo up to v7.0.0 (RC2) was discovered to contain an arbitrary file read vulnerability.
osv:CVE-2023-39584
Complete source record
{
"id": "8fcc79b029e9bf49792b9cc0785b54cc7610b8783ec89e3dc9fbcc2983a79715",
"url": "https://osv.dev/vulnerability/CVE-2023-39584",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2023-39584",
"summary": "Hexo up to v7.0.0 (RC2) was discovered to contain an arbitrary file read vulnerability.",
"evidence": "osv:CVE-2023-39584",
"products": [],
"severity": "unknown",
"structured": {
"id": "CVE-2023-39584",
"aliases": [
"CVE-2023-39584",
"GHSA-x2jc-989c-47q4"
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/hexojs/hexo",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"last_affected": "4d42d9d9345514828e60f5987fc054e9bedcac7b"
},
{
"introduced": "46fbdcfc98ef6d313c9a88f73b4b18079219ce7b"
},
{
"last_affected": "b3b444d7585920302a0e749614ada57317866a77"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:hexo:hexo:*:*:*:*:*:node.js:*:*",
"range": [
{
"introduced": "0"
},
{
"last_affected": "6.3.0"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:hexo:hexo:7.0.0:rc1:*:*:*:node.js:*:*",
"range": [
{
"introduced": "7.0.0-rc1"
},
{
"last_affected": "7.0.0-rc1"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:hexo:hexo:7.0.0:rc2:*:*:*:node.js:*:*",
"range": [
{
"introduced": "7.0.0-rc2"
},
{
"last_affected": "7.0.0-rc2"
}
],
"source": "CPE_STRING"
}
]
}
}
],
"versions": [
"7.0.0-rc1",
"7.0.0-rc2",
"v7.0.0-rc2",
"v7.0.0-rc1",
"6.3.0",
"6.2.0",
"6.1.0",
"5.4.0",
"6.0.0",
"5.3.0",
"5.2.0",
"5.1.1",
"5.1.0",
"5.0.2",
"5.0.1",
"5.0.0",
"4.2.0",
"4.1.1",
"4.1.0",
"4.0.0",
"3.9.0",
"3.8.0",
"3.7.1",
"3.7.0",
"3.6.0",
"3.5.0",
"3.4.4",
"3.4.3",
"3.4.2",
"3.4.1",
"3.4.0",
"3.3.9",
"3.3.8",
"3.3.7",
"3.3.6",
"3.3.5",
"3.3.0",
"3.2.2",
"3.2.1",
"3.2.0",
"3.2.0-beta.2",
"3.2.0-beta.1",
"3.1.1",
"3.1.0",
"3.0.1",
"3.0.0",
"3.0.0-rc.4",
"3.0.0-rc.3",
"3.0.0-rc.2",
"3.0.0-rc.1",
"3.0.0-beta.4",
"3.0.0-beta.3",
"3.0.0-beta.2",
"3.0.0-beta.1",
"2.8.3",
"2.8.2",
"2.8.1",
"2.8.0",
"2.7.1",
"2.7.0",
"2.6.3",
"2.6.2",
"2.6.1",
"2.5.7",
"2.5.6",
"2.5.5",
"2.5.4",
"2.5.3",
"2.5.0",
"2.4.5",
"2.4.4",
"2.4.3",
"2.4.2",
"2.4.1",
"2.4.0",
"2.3.0",
"2.1.0",
"2.0.7",
"2.0.6",
"2.0.5",
"2.0.4",
"2.0.3",
"2.0.2",
"2.0.1",
"2.0.0",
"1.2.4",
"1.2.3",
"1.2.2",
"1.2.1",
"1.2.0",
"1.1.4",
"1.1.3",
"1.1.2",
"1.1.1",
"1.1.0",
"1.0.9",
"1.0.8",
"1.0.7",
"1.0.6",
"1.0.5",
"1.0.4",
"1.0.2",
"1.0.1",
"1.0.0",
"0.5.12",
"0.5.11",
"0.5.10",
"0.5.9",
"0.5.8",
"0.5.7",
"0.5.6",
"0.5.5",
"0.5.4",
"0.5.3",
"0.5.2",
"0.5.1",
"0.5.0",
"0.4.5",
"0.4.4",
"0.4.3",
"0.4.2",
"0.4.1",
"0.4.0",
"0.3.2",
"0.3.1",
"0.3.0",
"0.2.1",
"0.2.0",
"0.1.11",
"0.1.10",
"0.1.9",
"0.1.8",
"0.1.7",
"0.1.6",
"0.1.5",
"0.1.4",
"0.1.3",
"0.1.2",
"0.1.1",
"0.1.0",
"0.0.6",
"0.0.5",
"0.0.4",
"0.0.3",
"0.0.2",
"0.0.1"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-39584.json"
}
}
],
"modified": "2026-10-28T02:30:43.158751375Z",
"provider": "osv",
"references": [
"https://github.com/hexojs/hexo/blob/a3e68e7576d279db22bd7481914286104e867834/lib/plugins/tag/include_code.js#L49",
"https://www.gem-love.com/2023/07/25/hexo%E5%8D%9A%E5%AE%A2%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E8%AF%BB%E5%8F%96%E5%92%8C%E4%BB%A3%E7%A0%81%E6%89%A7%E8%A1%8C%E6%BC%8F%E6%B4%9E/#undefined",
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/39xxx/CVE-2023-39584.json",
"https://nvd.nist.gov/vuln/detail/CVE-2023-39584",
"https://github.com/hexojs/hexo/issues/5250"
],
"provider_metadata": {
"cna_assigner": "mitre",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/39xxx/CVE-2023-39584.json"
}
},
"related_cves": [
{
"value": "CVE-2023-39584",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": null
},
"source_id": "core-osv",
"document_id": 510803,
"published_at": "2023-09-08T00:00:00+00:00"
}