Skip to contentGohugoio Hugo vulnerabilities
- gohugoio hugoHugo v0.60.0 before v0.167.0 Stored XSS via Table of Contents Heading IDsCVE-2026-109597Fix available5.1 Medium
- gohugoio hugoHugo from v0.162.0 before v0.167.0 Symlink File Disclosure via Nested Mount AncestorCVE-2026-109596Fix available6.7 Medium
- gohugoio hugoHugo v0.84.0 before v0.167.0 Path Traversal via js.Build ESBuild ResolverCVE-2026-109595Fix available6.7 Medium
- gohugoio hugoHugo before v0.167.0 Path Traversal via css.Sass Import FallbackCVE-2026-109574Fix available6.7 Medium
- gohugoio hugoHugo before v0.165.0 Insufficient Permission Restriction via TailwindCSSCVE-2026-89259Fix available9.3 Critical
- gohugoio hugoHugo before v0.165.0 Symlink Confinement Bypass via resources.GetCVE-2026-89258Fix available9.3 Critical
- gohugo hugoHugo before 0.166.0 Cross-Site Scripting via text/orgCVE-2026-100694Fix available5.1 Medium
- gohugo hugoHugo v0.162.0 before v0.166.0 IP-literal Deny Rule BypassCVE-2026-100693Fix available8.6 High
- gohugo hugoHugo before v0.166.0 Path Traversal via Symlinked Mount RootsCVE-2026-100692Fix available8.7 High
- gohugo hugoHugo before 0.166.0 Stored XSS via lineAnchors code block optionCVE-2026-100691Fix available5.1 Medium
- gohugo hugoHugo v0.161.0 to v0.165.0 Arbitrary File Read via SymlinksCVE-2026-100690Fix available8.7 High
- gohugo hugoHugo 0.93.0 through 0.165.0 Stored Cross-Site Scripting via Unescaped Code-Fence Attribute ValuesCVE-2026-10618Fix available4.8 Medium
- gohugoio hugoHugo 0.91.0 through 0.165.0 Server-Side Request Forgery via security.http.urls Lacking Destination Address ValidationCVE-2026-10582Fix available8.3 High
- gohugo hugoHugo 0.162.0 to 0.164.x - Node Permission Model Bypass via Default TailwindCSS Child-Process GrantCVE-2026-75926Fix available9.3 Critical
- gohugo hugoHugo security.http.urls deny rules bypassed by alternate IPv4 encodingsCVE-2026-58404Fix available4.6 Medium
- gohugo hugoHugo symlink confinement bypass in os.ReadFileCVE-2026-58403Fix available5.9 Medium
- gohugo hugoHugo default code block renderer XSS via unescaped code-fence languageCVE-2026-58402Fix available5.1 Medium
- gohugo hugoHugo: Symlink confinement bypass in resources.GetCVE-2026-50135Fix available6.9 Medium
- gohugo hugoHugo: security.http.urls allow-list bypass via HTTP redirectsCVE-2026-50134Fix available6.3 Medium
- gohugo hugoHugo: XSS via text/html content filesCVE-2026-50133Fix available5.1 Medium
- gohugo hugoHugo: Node tool execution allows file system access outside the project directoryCVE-2026-44301Fix available6.2 Medium
- gohugo hugoHugo does not properly escape some Markdown linksCVE-2026-35166Fix available5.3 Medium
- gohugoio hugoHugo does not escape some attributes in internal templatesCVE-2024-55601Fix available5.3 Medium
- gohugo hugoHugo doesn't escape markdown title in internal render hooksCVE-2024-32875Fix available6.1 Medium
- gohugo hugoHugo can execute a binary from the current directory on WindowsCVE-2020-26284Fix available7.7 High