Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

5 records

Release: gohugoio hugo 0.166.0 Clear all filters
TI-2026-64849 CVE-2026-100693 · GHSA-xpjr-56xg-vx6v

Hugo v0.162.0 before v0.166.0 IP-literal Deny Rule Bypass

Priority LOW 38

Hugo versions from v0.162.0 before v0.166.0 contain a case-sensitive validation flaw in the security.http.urls IP-literal deny rule that allows attackers to bypass restrictions.

CVSS 4.0HIGH 8.6 Local No auth No interaction EPSS 0.00139 Published 2026-09-26 Fixed in 0.166.0 CWE-178
TI-2026-64847 CVE-2026-100691 · GHSA-8v94-8989-vc79

Hugo before 0.166.0 Stored XSS via lineAnchors code block option

Priority LOW 22

Hugo versions 0.75.0 through 0.165.x contain a stored cross-site scripting vulnerability: the syntax highlighter does not escape the `lineAnchors` option before passing it to Chroma, which writes the value verbatim into…

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00172 Published 2026-09-26 Partial fix · 0.166.0 CWE-79
TI-2026-64846 CVE-2026-100690 · GHSA-gqg5-5gw3-54pq

Hugo v0.161.0 to v0.165.0 Arbitrary File Read via Symlinks

Priority MEDIUM 44

Hugo versions from v0.161.0 through v0.165.0 run Node.js tools (css.PostCSS, css.TailwindCSS, js.Babel) under the Node.js permission model to restrict file system reads to the project directory and configured mounts.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00356 Published 2026-09-26 Partial fix · 0.166.0 CWE-59