Gohugoio vulnerabilities
25 CVEs and advisories name Gohugoio as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-109597Hugo v0.60.0 before v0.167.0 Stored XSS via Table of Contents Heading IDs
- CVE-2026-109596Hugo from v0.162.0 before v0.167.0 Symlink File Disclosure via Nested Mount Ancestor
- CVE-2026-109595Hugo v0.84.0 before v0.167.0 Path Traversal via js.Build ESBuild Resolver
- CVE-2026-109574Hugo before v0.167.0 Path Traversal via css.Sass Import Fallback
- CVE-2026-100694Hugo before 0.166.0 Cross-Site Scripting via text/org
- CVE-2026-100693Hugo v0.162.0 before v0.166.0 IP-literal Deny Rule Bypass
- CVE-2026-100692Hugo before v0.166.0 Path Traversal via Symlinked Mount Roots
- CVE-2026-100691Hugo before 0.166.0 Stored XSS via lineAnchors code block option
- CVE-2026-100690Hugo v0.161.0 to v0.165.0 Arbitrary File Read via Symlinks
- CVE-2026-89259Hugo before v0.165.0 Insufficient Permission Restriction via TailwindCSS
- CVE-2026-89258Hugo before v0.165.0 Symlink Confinement Bypass via resources.Get
- CVE-2026-10618Hugo 0.93.0 through 0.165.0 Stored Cross-Site Scripting via Unescaped Code-Fence Attribute Values
- CVE-2026-10582Hugo 0.91.0 through 0.165.0 Server-Side Request Forgery via security.http.urls Lacking Destination Address Validation
- CVE-2026-75926Hugo 0.162.0 to 0.164.x - Node Permission Model Bypass via Default TailwindCSS Child-Process Grant
- CVE-2026-50135Hugo: Symlink confinement bypass in resources.Get
- CVE-2026-50134Hugo: security.http.urls allow-list bypass via HTTP redirects
- CVE-2026-50133Hugo: XSS via text/html content files
- CVE-2026-58403Hugo symlink confinement bypass in os.ReadFile
- CVE-2026-58402Hugo default code block renderer XSS via unescaped code-fence language
- CVE-2026-58404Hugo security.http.urls deny rules bypassed by alternate IPv4 encodings
- CVE-2026-44301Hugo: Node tool execution allows file system access outside the project directory
- CVE-2026-35166Hugo does not properly escape some Markdown links
- CVE-2024-55601Hugo does not escape some attributes in internal templates
- CVE-2024-32875Hugo doesn't escape markdown title in internal render hooks
- CVE-2020-26284Hugo can execute a binary from the current directory on Windows