XSS JS-AlertBox

support
1

I am running some Hugo Websites with NGINX. Currently, with Version:

hugo v0.83.1-5AFE0A57 linux/amd64 BuildDate=2021-05-02T14:38:05Z VendorInfo=gohugoio

We found some Problems with for example this URL:

https://gohugosite.example/asdf’onmouseover='alert(origin)’%2f…/

When I hover over an Image or a heading “copy link” button, I get an JS-AlertBox

With a local test, it does not work. Only when I get it on Docker/NGINX Server or normal NGINX Server. Does anybody have the same Problem or a Solution?

2

Your question is off-topic. Development issues not specific to Hugo should be raised elsewhere. You might try Stack Overflow.