Gohugo Hugo
9 CVEs affecting Gohugo Hugo. Latest disclosed: 2026-07-06. Critical: 0, High: 2.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-44301 | High | 8.1 | 2026-05-12 | Hugo is a static site generator. From 0.43 to before 0.161.0, when building a Hugo site that uses Node-based asset pipelines (PostCSS, Babel, TailwindCSS), Hug… |
CVE-2020-26284 | High | 7.7 | 2020-12-21 | Hugo is a fast and Flexible Static Site Generator built in Go. Hugo depends on Go's `os/exec` for certain features, e.g. for rendering of Pandoc documents if t… |
CVE-2026-58404 | Medium | 6.8 | 2026-07-06 | Hugo is a static site generator. From v0.162.0 through v0.163.0, the default security.http.urls policy denies requests to loopback, internal, and cloud-metadat… |
CVE-2026-58403 | Medium | 6.5 | 2026-07-06 | Hugo is a static site generator. From v0.123.0 through v0.163.0, Hugo's virtual filesystem is designed so that files under a mount cannot reach outside the mou… |
CVE-2026-50133 | Medium | 6.1 | 2026-07-06 | Hugo is a static site generator. Prior to 0.162.0, Hugo accepts content files in several markup formats. Files mapped to the text/html media type (typically .h… |
CVE-2026-50134 | Medium | 5.8 | 2026-07-06 | Hugo is a static site generator. From 0.91.0 until 0.162.0, resources.GetRemote enforces security.http.urls on the URL it is called with, but it did not re-val… |
CVE-2026-50135 | Medium | 5.5 | 2026-07-06 | Hugo is a static site generator. From 0.123.0 to 0.161.1, a regression made RootMappingFs.statRoot use Stat (follows symlinks) instead of Lstat , so a dir… |
CVE-2026-58402 | Medium | 5.4 | 2026-07-06 | Hugo is a static site generator. From 0.60.0 until 0.163.3, Hugo's default code-block renderer wrote the Markdown code-fence language or info-string into the c… |
CVE-2026-35166 | Medium | 5.4 | 2026-04-06 | Hugo is a static site generator. From 0.60.0 to before 0.159.2, links and image links in the default markdown to HTML renderer are not properly escaped. Hugo u… |