TI-2026-64848 CVE-2026-100692 · GHSA-m29q-9cm9-wcf6
Hugo before v0.166.0 Path Traversal via Symlinked Mount Roots
Priority MEDIUM 44
Hugo is a static site generator.
RHSA-2026:66266
Red Hat Hardened Images RPMs bug fix and enhancement update
Released 2026-09-09 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Hardened Images hugo-0.166.0-0.1.hum1@aarch64, hugo-0.166.0-0.1.hum1@src, hugo-0.166.0-0.1.hum1@x86_64
Fixes 9 records
TI-2026-64846 CVE-2026-100690 · GHSA-gqg5-5gw3-54pq
Hugo v0.161.0 to v0.165.0 Arbitrary File Read via Symlinks
Priority MEDIUM 44
Hugo versions from v0.161.0 through v0.165.0 run Node.js tools (css.PostCSS, css.TailwindCSS, js.Babel) under the Node.js permission model to restrict file system reads to the project directory and configured mounts.
TI-2026-64849 CVE-2026-100693 · GHSA-xpjr-56xg-vx6v
Hugo v0.162.0 before v0.166.0 IP-literal Deny Rule Bypass
Priority LOW 38
Hugo versions from v0.162.0 before v0.166.0 contain a case-sensitive validation flaw in the security.http.urls IP-literal deny rule that allows attackers to bypass restrictions.
TI-2026-09100 CVE-2026-10582 · GHSA-wg2f-v5x6-m39r
Hugo 0.91.0 through 0.165.0 Server-Side Request Forgery via security.http.urls Lacking Destination Address Validation
Priority LOW 36
Hugo's security.http.urls allowlist is the only control on outbound fetches made by resources.GetRemote, and it inspects the URL text alone.
TI-2026-32270 CVE-2026-44301 · GHSA-x597-9fr4-5857
Hugo: Node tool execution allows file system access outside the project directory
Priority LOW 33
Hugo is a static site generator.
TI-2026-26184 CVE-2026-33812
Excessive memory allocation when decoding malicious SFNT in golang.org/x/image
Priority LOW 26
Parsing a malicious font file can cause excessive memory allocation.
TI-2026-64850 CVE-2026-100694 · GHSA-98xc-jpvp-56pj
Hugo before 0.166.0 Cross-Site Scripting via text/org
Priority LOW 22
Hugo is a static site generator.
TI-2026-64847 CVE-2026-100691 · GHSA-8v94-8989-vc79
Hugo before 0.166.0 Stored XSS via lineAnchors code block option
Priority LOW 22
Hugo versions 0.75.0 through 0.165.x contain a stored cross-site scripting vulnerability: the syntax highlighter does not escape the `lineAnchors` option before passing it to Chroma, which writes the value verbatim into…
TI-2026-09125 CVE-2026-10618 · GHSA-2gp4-jcxx-7hpr
Hugo 0.93.0 through 0.165.0 Stored Cross-Site Scripting via Unescaped Code-Fence Attribute Values
Priority LOW 22
Hugo's default fenced-code-block renderer writes attribute values taken from the code-fence info string into the rendered HTML without escaping them.