TI-2026-64848 CVE-2026-100692 · GHSA-m29q-9cm9-wcf6
Hugo before v0.166.0 Path Traversal via Symlinked Mount Roots
Priority MEDIUM 44
Hugo is a static site generator.
gohugoio
Records25All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical3CVSS 9.0–10.0
CVSS high5CVSS 7.0–8.9
Exploited now
gohugoio records in CISA KEVNo gohugoio vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsRecords
16 records in Hugo · all components
TI-2026-64846 CVE-2026-100690 · GHSA-gqg5-5gw3-54pq
Hugo v0.161.0 to v0.165.0 Arbitrary File Read via Symlinks
Priority MEDIUM 44
Hugo versions from v0.161.0 through v0.165.0 run Node.js tools (css.PostCSS, css.TailwindCSS, js.Babel) under the Node.js permission model to restrict file system reads to the project directory and configured mounts.
TI-2026-53153 CVE-2026-75926 · GHSA-pxpg-7gfv-6wc9
Hugo 0.162.0 to 0.164.x - Node Permission Model Bypass via Default TailwindCSS Child-Process Grant
Priority MEDIUM 42
Hugo 0.161.0 placed the Node asset pipelines behind the Node.js permission model so that code running through PostCSS, Babel, or TailwindCSS could not reach the file system outside the project directory.
TI-2020-16105 CVE-2020-26284 · GHSA-8j34-9876-pvfq
Hugo can execute a binary from the current directory on Windows
Priority MEDIUM 40
Hugo is a fast and Flexible Static Site Generator built in Go.
TI-2026-64849 CVE-2026-100693 · GHSA-xpjr-56xg-vx6v
Hugo v0.162.0 before v0.166.0 IP-literal Deny Rule Bypass
Priority LOW 38
Hugo versions from v0.162.0 before v0.166.0 contain a case-sensitive validation flaw in the security.http.urls IP-literal deny rule that allows attackers to bypass restrictions.
TI-2026-32270 CVE-2026-44301 · GHSA-x597-9fr4-5857
Hugo: Node tool execution allows file system access outside the project directory
Priority LOW 33
Hugo is a static site generator.
TI-2026-36906 CVE-2026-50135 · GHSA-fw87-fv5r-9fpw
Hugo: Symlink confinement bypass in resources.Get
Priority LOW 31
Hugo is a static site generator.
TI-2026-36905 CVE-2026-50134 · GHSA-vxgm-5rmg-5w8g
Hugo: security.http.urls allow-list bypass via HTTP redirects
Priority LOW 28
Hugo is a static site generator.
TI-2026-42018 CVE-2026-58403
Hugo symlink confinement bypass in os.ReadFile
Priority LOW 27
Hugo is a static site generator.
Priority LOW 23
Hugo is a static site generator.
TI-2026-36904 CVE-2026-50133 · GHSA-c54g-xjwj-8g82
Hugo: XSS via text/html content files
Priority LOW 23
Hugo is a static site generator.
TI-2026-27320 CVE-2026-35166 · GHSA-mcv8-8m8x-48pg
Hugo does not properly escape some Markdown links
Priority LOW 23
Hugo is a static site generator.
TI-2026-64850 CVE-2026-100694 · GHSA-98xc-jpvp-56pj
Hugo before 0.166.0 Cross-Site Scripting via text/org
Priority LOW 22
Hugo is a static site generator.
TI-2026-64847 CVE-2026-100691 · GHSA-8v94-8989-vc79
Hugo before 0.166.0 Stored XSS via lineAnchors code block option
Priority LOW 22
Hugo versions 0.75.0 through 0.165.x contain a stored cross-site scripting vulnerability: the syntax highlighter does not escape the `lineAnchors` option before passing it to Chroma, which writes the value verbatim into…
TI-2026-09125 CVE-2026-10618 · GHSA-2gp4-jcxx-7hpr
Hugo 0.93.0 through 0.165.0 Stored Cross-Site Scripting via Unescaped Code-Fence Attribute Values
Priority LOW 22
Hugo's default fenced-code-block renderer writes attribute values taken from the code-fence info string into the rendered HTML without escaping them.
Priority LOW 21
Hugo is a static site generator.