Gohugoio Hugo
25 CVEs affecting Gohugoio Hugo. Latest disclosed: 2026-10-12. Critical: 1, High: 7.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-89259 | Critical | 9.8 | 2026-09-11 | Hugo is a static site generator. From v0.161.0, Hugo executes Node tools under Node's permission model, but TailwindCSS — included in the default security.exec… |
CVE-2026-75926 | High | 8.6 | 2026-08-18 | Hugo 0.161.0 placed the Node asset pipelines behind the Node.js permission model so that code running through PostCSS, Babel, or TailwindCSS could not reach th… |
CVE-2026-100693 | High | 8.4 | 2026-09-26 | Hugo versions from v0.162.0 before v0.166.0 contain a case-sensitive validation flaw in the security.http.urls IP-literal deny rule that allows attackers to by… |
CVE-2026-44301 | High | 8.1 | 2026-05-12 | Hugo is a static site generator. From 0.43 to before 0.161.0, when building a Hugo site that uses Node-based asset pipelines (PostCSS, Babel, TailwindCSS), Hug… |
CVE-2020-26284 | High | 7.7 | 2020-12-21 | Hugo is a fast and Flexible Static Site Generator built in Go. Hugo depends on Go's `os/exec` for certain features, e.g. for rendering of Pandoc documents if t… |
CVE-2026-100692 | High | 7.5 | 2026-09-26 | Hugo is a static site generator. In versions after v0.123.0 and before v0.166.0, Hugo's symlink confinement checks stopped at the mount root itself, so a theme… |
CVE-2026-100690 | High | 7.5 | 2026-09-26 | Hugo versions from v0.161.0 through v0.165.0 run Node.js tools (css.PostCSS, css.TailwindCSS, js.Babel) under the Node.js permission model to restrict file sys… |
CVE-2026-10582 | High | 7.4 | 2026-08-24 | Hugo's security.http.urls allowlist is the only control on outbound fetches made by resources.GetRemote, and it inspects the URL text alone. CheckAllowedHTTPUR… |
CVE-2026-58404 | Medium | 6.8 | 2026-07-06 | Hugo is a static site generator. From v0.162.0 through v0.163.0, the default security.http.urls policy denies requests to loopback, internal, and cloud-metadat… |
CVE-2026-58403 | Medium | 6.5 | 2026-07-06 | Hugo is a static site generator. From v0.123.0 through v0.163.0, Hugo's virtual filesystem is designed so that files under a mount cannot reach outside the mou… |
CVE-2026-89258 | Medium | 6.3 | 2026-09-11 | Hugo is a static site generator. In versions after v0.123.0 and before v0.165.0, symlinks in parent directories were not dropped during direct resource lookups… |
CVE-2026-100694 | Medium | 6.1 | 2026-09-26 | Hugo is a static site generator. In versions from v0.56.0 through v0.165.x, content files mapped to the text/org media type are rendered without escaping raw H… |
CVE-2026-50133 | Medium | 6.1 | 2026-07-06 | Hugo is a static site generator. Prior to 0.162.0, Hugo accepts content files in several markup formats. Files mapped to the text/html media type (typically .h… |
CVE-2024-32875 | Medium | 6.1 | 2024-04-23 | Hugo is a static site generator. Starting in version 0.123.0 and prior to version 0.125.3, title arguments in Markdown for links and images not escaped in inte… |
CVE-2026-50134 | Medium | 5.8 | 2026-07-06 | Hugo is a static site generator. From 0.91.0 until 0.162.0, resources.GetRemote enforces security.http.urls on the URL it is called with, but it did not re-val… |
CVE-2026-109596 | Medium | 5.5 | 2026-10-12 | Hugo from v0.162.0 before v0.167.0 contains an improper link resolution vulnerability that lets malicious themes or modules expose files outside their root via… |
CVE-2026-109595 | Medium | 5.5 | 2026-10-12 | Hugo from v0.84.0 before v0.167.0 contains a path traversal vulnerability that allows malicious themes or modules to read files outside the project root via ES… |
CVE-2026-109574 | Medium | 5.5 | 2026-10-12 | Hugo before v0.167.0 contains a path traversal vulnerability in css.Sass that allows malicious themes or modules to read files outside the project root through… |
CVE-2026-50135 | Medium | 5.5 | 2026-07-06 | Hugo is a static site generator. From 0.123.0 to 0.161.1, a regression made RootMappingFs.statRoot use Stat (follows symlinks) instead of Lstat , so a dir… |
CVE-2026-109597 | Medium | 5.4 | 2026-10-12 | Hugo from v0.60.0 before v0.167.0 contains a stored cross-site scripting vulnerability that allows Markdown content authors to inject HTML by supplying crafted… |