HU
Product
hugo
25
CVEs
0
On KEV
9.8
Max CVSS
4
New 30D
Severity mix
Critical 1High 7Medium 17Low 0
Watch
Add hugo to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-58404 | 6.8 | Jul 6 | Hugo security.http.urls deny rules bypassed by alternate IPv4 encodings Affected: >= v0.162.0, < v0.163.1 |
| CVE-2026-58403 | 6.5 | Jul 6 | Hugo symlink confinement bypass in os.ReadFile Affected: >= 0.123.0, < 0.163.1 |
| CVE-2026-89258 | 6.3 | Sep 11 | Hugo before v0.165.0 Symlink Confinement Bypass via resources.Get Affected: before 0.165.0 |
| CVE-2026-100694 | 6.1 | Sep 26 | Hugo before 0.166.0 Cross-Site Scripting via text/org Affected: 0.56.0 before 0.166.0 |
| CVE-2026-50133 | 6.1 | Jul 6 | Hugo: XSS via text/html content files Affected: < 0.162.0 |
| CVE-2024-32875 | 6.1 | Apr 23 | Hugo doesn't escape markdown title in internal render hooks Affected: >= 0.123.0, < 0.125.3 |
| CVE-2026-50134 | 5.8 | Jul 6 | Hugo: security.http.urls allow-list bypass via HTTP redirects Affected: >= 0.91.0, < 0.162.0 |
| CVE-2026-109596 | 5.5 | Oct 12 | Hugo from v0.162.0 before v0.167.0 Symlink File Disclosure via Nested Mount Ancestor Affected: 0.162.0 before 0.167.0 |
| CVE-2026-109595 | 5.5 | Oct 12 | Hugo v0.84.0 before v0.167.0 Path Traversal via js.Build ESBuild Resolver Affected: 0.84.0 before 0.167.0 |
| CVE-2026-109574 | 5.5 | Oct 12 | Hugo before v0.167.0 Path Traversal via css.Sass Import Fallback Affected: before 0.167.0 |
| CVE-2026-50135 | 5.5 | Jul 6 | Hugo: Symlink confinement bypass in resources.Get Affected: >= 0.123.0, < 0.162.0 |
| CVE-2026-109597 | 5.4 | Oct 12 | Hugo v0.60.0 before v0.167.0 Stored XSS via Table of Contents Heading IDs Affected: 0.60.0 before 0.167.0 |
| CVE-2026-100691 | 5.4 | Sep 26 | Hugo before 0.166.0 Stored XSS via lineAnchors code block option Affected: 0.75.0 before 0.166.0 |
| CVE-2026-10618 | 5.4 | Aug 24 | Hugo 0.93.0 through 0.165.0 Stored Cross-Site Scripting via Unescaped Code-Fence Attribute Values Affected: 0.93.0 through 0.165.0 |
| CVE-2026-58402 | 5.4 | Jul 6 | Hugo default code block renderer XSS via unescaped code-fence language Affected: >= 0.60.0, < 0.163.3 |
| CVE-2026-35166 | 5.4 | Apr 6 | Hugo does not properly escape some Markdown links Affected: >= 0.60.0, < 0.159.2 |
| CVE-2024-55601 | 5.3 | Dec 9 | Hugo does not escape some attributes in internal templates Affected: >= 0.123.0, < 0.139.4 |
Showing 17