Hexo versions 0.0.1 to 5.4.0 are vulnerable against stored XSS. The post “body� and “tags� don’t sanitize malicious javascript during web page generation. Local unprivileged attacker can inject arbitrary code.