What’s Vulnerable › Products

gohugoio hugo vulnerabilities

25 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 23 published in the last 12 months.

Check whether your gohugoio hugo version is affected

Latest gohugoio hugo vulnerabilities

• CVE-2026-109597 — Hugo v0.60.0 before v0.167.0 Stored XSS via Table of Contents Heading IDs (CVSS 5.4)
• CVE-2026-109596 — Hugo from v0.162.0 before v0.167.0 Symlink File Disclosure via Nested Mount Ancestor (CVSS 5.5)
• CVE-2026-109595 — Hugo v0.84.0 before v0.167.0 Path Traversal via js.Build ESBuild Resolver (CVSS 5.5)
• CVE-2026-109574 — Hugo before v0.167.0 Path Traversal via css.Sass Import Fallback (CVSS 5.5)
• CVE-2026-100694 — Hugo before 0.166.0 Cross-Site Scripting via text/org (CVSS 6.1)
• CVE-2026-100693 — Hugo v0.162.0 before v0.166.0 IP-literal Deny Rule Bypass (CVSS 8.4)
• CVE-2026-100692 — Hugo before v0.166.0 Path Traversal via Symlinked Mount Roots (CVSS 7.5)
• CVE-2026-100691 — Hugo before 0.166.0 Stored XSS via lineAnchors code block option (CVSS 5.4)
• CVE-2026-100690 — Hugo v0.161.0 to v0.165.0 Arbitrary File Read via Symlinks (CVSS 7.5)
• CVE-2026-89259 — Hugo before v0.165.0 Insufficient Permission Restriction via TailwindCSS (CVSS 9.8)
• CVE-2026-89258 — Hugo before v0.165.0 Symlink Confinement Bypass via resources.Get (CVSS 6.3)
• CVE-2026-10618 — Hugo 0.93.0 through 0.165.0 Stored Cross-Site Scripting via Unescaped Code-Fence Attribute Values (CVSS 5.4)
• CVE-2026-10582 — Hugo 0.91.0 through 0.165.0 Server-Side Request Forgery via security.http.urls Lacking Destination Address Validation (CVSS 7.4)
• CVE-2026-75926 — Hugo 0.162.0 to 0.164.x - Node Permission Model Bypass via Default TailwindCSS Child-Process Grant (CVSS 8.6)
• CVE-2026-50135 — Hugo: Symlink confinement bypass in resources.Get (CVSS 5.5)
• CVE-2026-58404 — Hugo security.http.urls deny rules bypassed by alternate IPv4 encodings (CVSS 6.8)
• CVE-2026-58403 — Hugo symlink confinement bypass in os.ReadFile (CVSS 6.5)
• CVE-2026-58402 — Hugo default code block renderer XSS via unescaped code-fence language (CVSS 5.4)
• CVE-2026-50134 — Hugo: security.http.urls allow-list bypass via HTTP redirects (CVSS 5.8)
• CVE-2026-50133 — Hugo: XSS via text/html content files (CVSS 6.1)
• CVE-2026-44301 — Hugo: Node tool execution allows file system access outside the project directory (CVSS 8.1)
• CVE-2026-35166 — Hugo does not properly escape some Markdown links (CVSS 5.4)
• CVE-2024-55601 — Hugo does not escape some attributes in internal templates (CVSS 5.3)
• CVE-2024-32875 — Hugo doesn't escape markdown title in internal render hooks (CVSS 6.1)
• CVE-2020-26284 — Hugo can execute a binary from the current directory on Windows (CVSS 8.5)