# cve.now: Gohugoio

The newest entries naming Gohugoio as an affected vendor (up to 200), of 25 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-109597](https://cve.now/CVE-2026-109597.md): Hugo v0.60.0 before v0.167.0 Stored XSS via Table of Contents Heading IDs (CVSS 5.1)
- [CVE-2026-109596](https://cve.now/CVE-2026-109596.md): Hugo from v0.162.0 before v0.167.0 Symlink File Disclosure via Nested Mount Ancestor (CVSS 6.7)
- [CVE-2026-109595](https://cve.now/CVE-2026-109595.md): Hugo v0.84.0 before v0.167.0 Path Traversal via js.Build ESBuild Resolver (CVSS 6.7)
- [CVE-2026-109574](https://cve.now/CVE-2026-109574.md): Hugo before v0.167.0 Path Traversal via css.Sass Import Fallback (CVSS 6.7)
- [CVE-2026-100694](https://cve.now/CVE-2026-100694.md): Hugo before 0.166.0 Cross-Site Scripting via text/org (CVSS 5.1)
- [CVE-2026-100693](https://cve.now/CVE-2026-100693.md): Hugo v0.162.0 before v0.166.0 IP-literal Deny Rule Bypass (CVSS 8.6)
- [CVE-2026-100692](https://cve.now/CVE-2026-100692.md): Hugo before v0.166.0 Path Traversal via Symlinked Mount Roots (CVSS 8.7)
- [CVE-2026-100691](https://cve.now/CVE-2026-100691.md): Hugo before 0.166.0 Stored XSS via lineAnchors code block option (CVSS 5.1)
- [CVE-2026-100690](https://cve.now/CVE-2026-100690.md): Hugo v0.161.0 to v0.165.0 Arbitrary File Read via Symlinks (CVSS 8.7)
- [CVE-2026-89259](https://cve.now/CVE-2026-89259.md): Hugo before v0.165.0 Insufficient Permission Restriction via TailwindCSS (CVSS 9.3)
- [CVE-2026-89258](https://cve.now/CVE-2026-89258.md): Hugo before v0.165.0 Symlink Confinement Bypass via resources.Get (CVSS 9.3)
- [CVE-2026-10618](https://cve.now/CVE-2026-10618.md): Hugo 0.93.0 through 0.165.0 Stored Cross-Site Scripting via Unescaped Code-Fence Attribute Values (CVSS 4.8)
- [CVE-2026-10582](https://cve.now/CVE-2026-10582.md): Hugo 0.91.0 through 0.165.0 Server-Side Request Forgery via security.http.urls Lacking Destination Address Validation (CVSS 8.3)
- [CVE-2026-75926](https://cve.now/CVE-2026-75926.md): Hugo 0.162.0 to 0.164.x - Node Permission Model Bypass via Default TailwindCSS Child-Process Grant (CVSS 9.3)
- [CVE-2026-50135](https://cve.now/CVE-2026-50135.md): Hugo: Symlink confinement bypass in resources.Get (CVSS 6.9)
- [CVE-2026-50134](https://cve.now/CVE-2026-50134.md): Hugo: security.http.urls allow-list bypass via HTTP redirects (CVSS 6.3)
- [CVE-2026-50133](https://cve.now/CVE-2026-50133.md): Hugo: XSS via text/html content files (CVSS 5.1)
- [CVE-2026-58403](https://cve.now/CVE-2026-58403.md): Hugo symlink confinement bypass in os.ReadFile (CVSS 5.9)
- [CVE-2026-58402](https://cve.now/CVE-2026-58402.md): Hugo default code block renderer XSS via unescaped code-fence language (CVSS 5.1)
- [CVE-2026-58404](https://cve.now/CVE-2026-58404.md): Hugo security.http.urls deny rules bypassed by alternate IPv4 encodings (CVSS 4.6)
- [CVE-2026-44301](https://cve.now/CVE-2026-44301.md): Hugo: Node tool execution allows file system access outside the project directory (CVSS 6.2)
- [CVE-2026-35166](https://cve.now/CVE-2026-35166.md): Hugo does not properly escape some Markdown links (CVSS 5.3)
- [CVE-2024-55601](https://cve.now/CVE-2024-55601.md): Hugo does not escape some attributes in internal templates (CVSS 5.3)
- [CVE-2024-32875](https://cve.now/CVE-2024-32875.md): Hugo doesn't escape markdown title in internal render hooks (CVSS 6.1)
- [CVE-2020-26284](https://cve.now/CVE-2020-26284.md): Hugo can execute a binary from the current directory on Windows (CVSS 7.7)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/gohugoio
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.