Gohugoio vulnerabilities

Products

• Hugo 25

Newest

• gohugoio hugo Hugo v0.60.0 before v0.167.0 Stored XSS via Table of Contents Heading IDs CVE-2026-109597 Fix available 5.1 MediumOctober 12, 2026
• gohugoio hugo Hugo from v0.162.0 before v0.167.0 Symlink File Disclosure via Nested Mount Ancestor CVE-2026-109596 Fix available 6.7 MediumOctober 12, 2026
• gohugoio hugo Hugo v0.84.0 before v0.167.0 Path Traversal via js.Build ESBuild Resolver CVE-2026-109595 Fix available 6.7 MediumOctober 12, 2026
• gohugoio hugo Hugo before v0.167.0 Path Traversal via css.Sass Import Fallback CVE-2026-109574 Fix available 6.7 MediumOctober 12, 2026
• gohugoio hugo Hugo before v0.165.0 Insufficient Permission Restriction via TailwindCSS CVE-2026-89259 Fix available 9.3 CriticalSeptember 11, 2026
• gohugoio hugo Hugo before v0.165.0 Symlink Confinement Bypass via resources.Get CVE-2026-89258 Fix available 9.3 CriticalSeptember 11, 2026
• gohugo hugo Hugo before 0.166.0 Cross-Site Scripting via text/org CVE-2026-100694 Fix available 5.1 MediumSeptember 10, 2026
• gohugo hugo Hugo v0.162.0 before v0.166.0 IP-literal Deny Rule Bypass CVE-2026-100693 Fix available 8.6 HighSeptember 10, 2026
• gohugo hugo Hugo before v0.166.0 Path Traversal via Symlinked Mount Roots CVE-2026-100692 Fix available 8.7 HighSeptember 10, 2026
• gohugo hugo Hugo before 0.166.0 Stored XSS via lineAnchors code block option CVE-2026-100691 Fix available 5.1 MediumSeptember 10, 2026
• gohugo hugo Hugo v0.161.0 to v0.165.0 Arbitrary File Read via Symlinks CVE-2026-100690 Fix available 8.7 HighSeptember 10, 2026
• gohugo hugo Hugo 0.93.0 through 0.165.0 Stored Cross-Site Scripting via Unescaped Code-Fence Attribute Values CVE-2026-10618 Fix available 4.8 MediumAugust 24, 2026
• gohugoio hugo Hugo 0.91.0 through 0.165.0 Server-Side Request Forgery via security.http.urls Lacking Destination Address Validation CVE-2026-10582 Fix available 8.3 HighAugust 24, 2026
• gohugo hugo Hugo 0.162.0 to 0.164.x - Node Permission Model Bypass via Default TailwindCSS Child-Process Grant CVE-2026-75926 Fix available 9.3 CriticalAugust 18, 2026
• gohugo hugo Hugo security.http.urls deny rules bypassed by alternate IPv4 encodings CVE-2026-58404 Fix available 4.6 MediumJune 19, 2026
• gohugo hugo Hugo symlink confinement bypass in os.ReadFile CVE-2026-58403 Fix available 5.9 MediumJune 19, 2026
• gohugo hugo Hugo default code block renderer XSS via unescaped code-fence language CVE-2026-58402 Fix available 5.1 MediumJune 19, 2026
• gohugo hugo Hugo: Symlink confinement bypass in resources.Get CVE-2026-50135 Fix available 6.9 MediumJune 16, 2026
• gohugo hugo Hugo: security.http.urls allow-list bypass via HTTP redirects CVE-2026-50134 Fix available 6.3 MediumJune 16, 2026
• gohugo hugo Hugo: XSS via text/html content files CVE-2026-50133 Fix available 5.1 MediumJune 16, 2026
• gohugo hugo Hugo: Node tool execution allows file system access outside the project directory CVE-2026-44301 Fix available 6.2 MediumMay 6, 2026
• gohugo hugo Hugo does not properly escape some Markdown links CVE-2026-35166 Fix available 5.3 MediumApril 3, 2026
• gohugoio hugo Hugo does not escape some attributes in internal templates CVE-2024-55601 Fix available 5.3 MediumDecember 9, 2024
• gohugo hugo Hugo doesn't escape markdown title in internal render hooks CVE-2024-32875 Fix available 6.1 MediumApril 23, 2024
• gohugo hugo Hugo can execute a binary from the current directory on Windows CVE-2020-26284 Fix available 7.7 HighDecember 21, 2020