TI-2024-16303 CVE-2024-24786 · GHSA-8r3f-844c-mc37
Infinite loop in JSON unmarshaling in google.golang.org/protobuf
Priority MEDIUM 41
The protojson.Unmarshal function can enter an infinite loop when unmarshaling certain forms of invalid JSON.
RHSA-2026:80677
Red Hat Hardened Images RPMs bug fix and enhancement update
Released 2026-10-12 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Hardened Images hugo-0.167.0-0.2.hum1@aarch64, hugo-0.167.0-0.2.hum1@s390x, hugo-0.167.0-0.2.hum1@src +1
Fixes 5 records
TI-2026-71361 CVE-2026-109596 · GHSA-38r7-h6rh-gjv9
Symlink following in Hugo exposes files outside theme root
Priority LOW 29
Hugo from v0.162.0 before v0.167.0 contains an improper link resolution vulnerability that lets malicious themes or modules expose files outside their root via nested-mount ancestor directories.
TI-2026-71360 CVE-2026-109595 · GHSA-6cfm-3xc5-q3r5
Hugo path traversal in js.Build ESBuild resolver exposes files outside project
Priority LOW 29
Hugo from v0.84.0 before v0.167.0 contains a path traversal vulnerability that allows malicious themes or modules to read files outside the project root via ESBuild's fallback resolver in js.Build, js.Batch, and css.Buil…
TI-2026-71359 CVE-2026-109574 · GHSA-454m-4vr5-7p63
Path traversal in Hugo css.Sass exposes files outside project root
Priority LOW 29
Hugo before v0.167.0 contains a path traversal vulnerability in css.Sass that allows malicious themes or modules to read files outside the project root through the Sass compiler's import fallback.
TI-2026-71362 CVE-2026-109597 · GHSA-hh58-7hgh-xf3r
Stored cross-site scripting in Hugo via table of contents heading IDs
Priority LOW 22
Hugo from v0.60.0 before v0.167.0 contains a stored cross-site scripting vulnerability that allows Markdown content authors to inject HTML by supplying crafted explicit heading IDs.