github.com/gohugoio/hugo vulnerabilities (Go)

11 vulnerabilities.

• github.com/gohugoio/hugo Go Hugo security.http.urls deny rules bypassed by alternate IPv4 encodings CVE-2026-58404 Fix available 4.6 MediumJune 19, 2026
• github.com/gohugoio/hugo Go Hugo symlink confinement bypass in os.ReadFile CVE-2026-58403 Fix available 5.9 MediumJune 19, 2026
• github.com/gohugoio/hugo Go Hugo default code block renderer XSS via unescaped code-fence language CVE-2026-58402 Fix available 5.1 MediumJune 19, 2026
• github.com/gohugoio/hugo Go Hugo: Symlink confinement bypass in resources.Get CVE-2026-50135 Fix available 6.9 MediumJune 16, 2026
• github.com/gohugoio/hugo Go Hugo: security.http.urls allow-list bypass via HTTP redirects CVE-2026-50134 Fix available 6.3 MediumJune 16, 2026
• github.com/gohugoio/hugo Go Hugo: XSS via text/html content files CVE-2026-50133 Fix available 5.1 MediumJune 16, 2026
• github.com/gohugoio/hugo Go Hugo: Node tool execution allows file system access outside the project directory CVE-2026-44301 Fix available 6.2 MediumMay 6, 2026
• github.com/gohugoio/hugo Go Hugo does not properly escape some Markdown links CVE-2026-35166 Fix available 5.3 MediumApril 3, 2026
• github.com/gohugoio/hugo Go Hugo does not escape some attributes in internal templates CVE-2024-55601 Fix available 5.3 MediumDecember 9, 2024
• github.com/gohugoio/hugo Go Hugo doesn't escape markdown title in internal render hooks CVE-2024-32875 Fix available 6.1 MediumApril 23, 2024
• github.com/gohugoio/hugo Go Hugo can execute a binary from the current directory on Windows CVE-2020-26284 Fix available 7.7 HighDecember 21, 2020