Read the docs

gohugoio

Records25All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical3CVSS 9.0–10.0
CVSS high5CVSS 7.0–8.9

Exploited now

gohugoio records in CISA KEV

No gohugoio vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Hugo 16 records MEDIUM

Records

25 records

TI-2026-64846 CVE-2026-100690 · GHSA-gqg5-5gw3-54pq

Hugo v0.161.0 to v0.165.0 Arbitrary File Read via Symlinks

Priority MEDIUM 44

Hugo versions from v0.161.0 through v0.165.0 run Node.js tools (css.PostCSS, css.TailwindCSS, js.Babel) under the Node.js permission model to restrict file system reads to the project directory and configured mounts.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00356 Published 2026-09-26 Partial fix · 0.166.0 CWE-59
TI-2026-64849 CVE-2026-100693 · GHSA-xpjr-56xg-vx6v

Hugo v0.162.0 before v0.166.0 IP-literal Deny Rule Bypass

Priority LOW 38

Hugo versions from v0.162.0 before v0.166.0 contain a case-sensitive validation flaw in the security.http.urls IP-literal deny rule that allows attackers to bypass restrictions.

CVSS 4.0HIGH 8.6 Local No auth No interaction EPSS 0.00139 Published 2026-09-26 Fixed in 0.166.0 CWE-178
TI-2026-71361 CVE-2026-109596 · GHSA-38r7-h6rh-gjv9

Symlink following in Hugo exposes files outside theme root

Priority LOW 29

Hugo from v0.162.0 before v0.167.0 contains an improper link resolution vulnerability that lets malicious themes or modules expose files outside their root via nested-mount ancestor directories.

CVSS 4.0MEDIUM 6.7 Local No auth User interaction EPSS 0.00144 Published 2026-10-12 Partial fix · 0.167.0 CWE-59
TI-2026-71360 CVE-2026-109595 · GHSA-6cfm-3xc5-q3r5

Hugo path traversal in js.Build ESBuild resolver exposes files outside project

Priority LOW 29

Hugo from v0.84.0 before v0.167.0 contains a path traversal vulnerability that allows malicious themes or modules to read files outside the project root via ESBuild's fallback resolver in js.Build, js.Batch, and css.Buil…

CVSS 4.0MEDIUM 6.7 Local No auth User interaction EPSS 0.00144 Published 2026-10-12 Partial fix · 0.167.0 CWE-22
TI-2026-71359 CVE-2026-109574 · GHSA-454m-4vr5-7p63

Path traversal in Hugo css.Sass exposes files outside project root

Priority LOW 29

Hugo before v0.167.0 contains a path traversal vulnerability in css.Sass that allows malicious themes or modules to read files outside the project root through the Sass compiler's import fallback.

CVSS 4.0MEDIUM 6.7 Local No auth User interaction EPSS 0.00144 Published 2026-10-12 Partial fix · 0.167.0 CWE-22
TI-2026-36904 CVE-2026-50133 · GHSA-c54g-xjwj-8g82

Hugo: XSS via text/html content files

Priority LOW 23

Hugo is a static site generator.

CVSS 4.0MEDIUM 5.1 Network No auth User interaction EPSS 0.00327 Published 2026-07-06 Fixed in 0.162.0 CWE-79
TI-2026-71362 CVE-2026-109597 · GHSA-hh58-7hgh-xf3r

Stored cross-site scripting in Hugo via table of contents heading IDs

Priority LOW 22

Hugo from v0.60.0 before v0.167.0 contains a stored cross-site scripting vulnerability that allows Markdown content authors to inject HTML by supplying crafted explicit heading IDs.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00168 Published 2026-10-12 Partial fix · 0.167.0 CWE-79
TI-2026-64847 CVE-2026-100691 · GHSA-8v94-8989-vc79

Hugo before 0.166.0 Stored XSS via lineAnchors code block option

Priority LOW 22

Hugo versions 0.75.0 through 0.165.x contain a stored cross-site scripting vulnerability: the syntax highlighter does not escape the `lineAnchors` option before passing it to Chroma, which writes the value verbatim into…

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00172 Published 2026-09-26 Partial fix · 0.166.0 CWE-79
Open these records in search →