# github.com/gohugoio/hugo (Go) vulnerabilities

11 known vulnerabilities (1 high, 10 medium), with the versions each affects and the releases that fix them.

## At a glance

- Latest release: not known (cve.now hasn't read this package's releases)
- Newest unaffected release: not known without release data
- Registry: https://pkg.go.dev/github.com/gohugoio/hugo

## Advisories (11)

### [CVE-2026-50135](https://cve.now/CVE-2026-50135): Hugo: Symlink confinement bypass in resources.Get

- Severity: Medium 6.9
- Published: Jul 6, 2026
- Affected: from 0.123.0, fixed in 0.162.0.

### [CVE-2026-50134](https://cve.now/CVE-2026-50134): Hugo: security.http.urls allow-list bypass via HTTP redirects

- Severity: Medium 6.3
- Published: Jul 6, 2026
- Affected: from 0.91.0, fixed in 0.162.0.

### [CVE-2026-50133](https://cve.now/CVE-2026-50133): Hugo: XSS via text/html content files

- Severity: Medium 5.1
- Published: Jul 6, 2026
- Affected: fixed in 0.162.0.

### [CVE-2026-58403](https://cve.now/CVE-2026-58403): Hugo symlink confinement bypass in os.ReadFile

- Severity: Medium 5.9
- Published: Jul 6, 2026
- Affected: from 0.123.0, fixed in 0.163.1.

### [CVE-2026-58402](https://cve.now/CVE-2026-58402): Hugo default code block renderer XSS via unescaped code-fence language

- Severity: Medium 5.1
- Published: Jul 6, 2026
- Affected: from 0.60.0, fixed in 0.163.3.

### [CVE-2026-58404](https://cve.now/CVE-2026-58404): Hugo security.http.urls deny rules bypassed by alternate IPv4 encodings

- Severity: Medium 4.6
- Published: Jul 6, 2026
- Affected: from 0.162.0, fixed in 0.163.1.

### [CVE-2026-44301](https://cve.now/CVE-2026-44301): Hugo: Node tool execution allows file system access outside the project directory

- Severity: Medium 6.2
- Published: May 12, 2026
- Affected: from 0.43.0, fixed in 0.161.0; fixed in 0.161.0.

### [CVE-2026-35166](https://cve.now/CVE-2026-35166): Hugo does not properly escape some Markdown links

- Severity: Medium 5.3
- Published: Apr 6, 2026
- Affected: from 0.60.0, fixed in 0.159.2.

### [CVE-2024-55601](https://cve.now/CVE-2024-55601): Hugo does not escape some attributes in internal templates

- Severity: Medium 5.3
- Published: Dec 9, 2024
- Affected: from 0.123.0, fixed in 0.139.4.

### [CVE-2024-32875](https://cve.now/CVE-2024-32875): Hugo doesn't escape markdown title in internal render hooks

- Severity: Medium 6.1
- Published: Apr 23, 2024
- Affected: from 0.123.0, fixed in 0.125.3.

### [CVE-2020-26284](https://cve.now/CVE-2020-26284): Hugo can execute a binary from the current directory on Windows

- Severity: High 7.7
- Published: Dec 21, 2020
- Affected: fixed in 0.79.1.

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/packages/go/github.com/gohugoio/hugo
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.