[ Vendor · 9 CVEs ]
gohugoio
CVEs affecting gohugoio published in the last 30 days, plus any gohugoio CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-109596 | 12 Oct 2026 | CVSS 5.5 | gohugoio hugoHugo from v0.162.0 before v0.167.0 contains an improper link resolution vulnerability that lets malicious themes or modules expose files outside… | |
| CVE-2026-109597 | 12 Oct 2026 | CVSS 5.4 | gohugoio hugoHugo from v0.60.0 before v0.167.0 contains a stored cross-site scripting vulnerability that allows Markdown content authors to inject HTML by… | |
| CVE-2026-109574 | 12 Oct 2026 | CVSS 5.5 | gohugoio hugoHugo before v0.167.0 contains a path traversal vulnerability in css.Sass that allows malicious themes or modules to read files outside the project… | |
| CVE-2026-109595 | 12 Oct 2026 | CVSS 5.5 | gohugoio hugoHugo from v0.84.0 before v0.167.0 contains a path traversal vulnerability that allows malicious themes or modules to read files outside the project… | |
| CVE-2026-100693 | 26 Sep 2026 | CVSS 8.4 | gohugoio hugoHugo versions from v0.162.0 before v0.166.0 contain a case-sensitive validation flaw in the security.http.urls IP-literal deny rule that allows… | |
| CVE-2026-100694 | 26 Sep 2026 | CVSS 6.1 | gohugoio hugoHugo is a static site generator. In versions from v0.56.0 through v0.165.x, content files mapped to the text/org media type are rendered without… | |
| CVE-2026-100690 | 26 Sep 2026 | CVSS 7.5 | gohugoio hugoHugo versions from v0.161.0 through v0.165.0 run Node.js tools (css.PostCSS, css.TailwindCSS, js.Babel) under the Node.js permission model to… | |
| CVE-2026-100691 | 26 Sep 2026 | CVSS 5.4 | gohugoio hugoHugo versions 0.75.0 through 0.165.x contain a stored cross-site scripting vulnerability: the syntax highlighter does not escape the `lineAnchors`… | |
| CVE-2026-100692 | 26 Sep 2026 | CVSS 7.5 | gohugoio hugoHugo is a static site generator. In versions after v0.123.0 and before v0.166.0, Hugo's symlink confinement checks stopped at the mount root itself… |