Skip to contentGohugo Hugo vulnerabilities
- gohugo hugoHugo before 0.166.0 Cross-Site Scripting via text/orgCVE-2026-100694Fix available5.1 Medium
- gohugo hugoHugo v0.162.0 before v0.166.0 IP-literal Deny Rule BypassCVE-2026-100693Fix available8.6 High
- gohugo hugoHugo before v0.166.0 Path Traversal via Symlinked Mount RootsCVE-2026-100692Fix available8.7 High
- gohugo hugoHugo before 0.166.0 Stored XSS via lineAnchors code block optionCVE-2026-100691Fix available5.1 Medium
- gohugo hugoHugo v0.161.0 to v0.165.0 Arbitrary File Read via SymlinksCVE-2026-100690Fix available8.7 High
- gohugo hugoHugo 0.93.0 through 0.165.0 Stored Cross-Site Scripting via Unescaped Code-Fence Attribute ValuesCVE-2026-10618Fix available4.8 Medium
- gohugo hugoHugo 0.162.0 to 0.164.x - Node Permission Model Bypass via Default TailwindCSS Child-Process GrantCVE-2026-75926Fix available9.3 Critical
- gohugo hugoHugo security.http.urls deny rules bypassed by alternate IPv4 encodingsCVE-2026-58404Fix available4.6 Medium
- gohugo hugoHugo symlink confinement bypass in os.ReadFileCVE-2026-58403Fix available5.9 Medium
- gohugo hugoHugo default code block renderer XSS via unescaped code-fence languageCVE-2026-58402Fix available5.1 Medium
- gohugo hugoHugo: Symlink confinement bypass in resources.GetCVE-2026-50135Fix available6.9 Medium
- gohugo hugoHugo: security.http.urls allow-list bypass via HTTP redirectsCVE-2026-50134Fix available6.3 Medium
- gohugo hugoHugo: XSS via text/html content filesCVE-2026-50133Fix available5.1 Medium
- gohugo hugoHugo: Node tool execution allows file system access outside the project directoryCVE-2026-44301Fix available6.2 Medium
- gohugo hugoHugo does not properly escape some Markdown linksCVE-2026-35166Fix available5.3 Medium
- gohugo hugoHugo doesn't escape markdown title in internal render hooksCVE-2024-32875Fix available6.1 Medium
- gohugo hugoHugo can execute a binary from the current directory on WindowsCVE-2020-26284Fix available7.7 High