Skip to main content
cve.nowby Sazabi
← Go
GoPackage

github.com/gohugoio/hugo

11 known vulnerabilities (1 high, 10 medium), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
11 · 1 high, 10 medium
Registry
pkg.go.dev

Advisories 11

  • CVE-2026-50135Medium 6.9

    Hugo: Symlink confinement bypass in resources.Get

    Affected: from 0.123.0, fixed in 0.162.0.

  • CVE-2026-50134Medium 6.3

    Hugo: security.http.urls allow-list bypass via HTTP redirects

    Affected: from 0.91.0, fixed in 0.162.0.

  • CVE-2026-50133Medium 5.1

    Hugo: XSS via text/html content files

    Affected: fixed in 0.162.0.

  • CVE-2026-58403Medium 5.9

    Hugo symlink confinement bypass in os.ReadFile

    Affected: from 0.123.0, fixed in 0.163.1.

  • CVE-2026-58402Medium 5.1

    Hugo default code block renderer XSS via unescaped code-fence language

    Affected: from 0.60.0, fixed in 0.163.3.

  • CVE-2026-58404Medium 4.6

    Hugo security.http.urls deny rules bypassed by alternate IPv4 encodings

    Affected: from 0.162.0, fixed in 0.163.1.

  • CVE-2026-44301Medium 6.2

    Hugo: Node tool execution allows file system access outside the project directory

    Affected: from 0.43.0, fixed in 0.161.0; fixed in 0.161.0.

  • CVE-2026-35166Medium 5.3

    Hugo does not properly escape some Markdown links

    Affected: from 0.60.0, fixed in 0.159.2.

  • CVE-2024-55601Medium 5.3

    Hugo does not escape some attributes in internal templates

    Affected: from 0.123.0, fixed in 0.139.4.

  • CVE-2024-32875Medium 6.1

    Hugo doesn't escape markdown title in internal render hooks

    Affected: from 0.123.0, fixed in 0.125.3.

  • Hugo can execute a binary from the current directory on Windows

    Affected: fixed in 0.79.1.