534 matches found
CVE-2026-10582
Hugo's security.http.urls allowlist is the only control on outbound fetches made by resources.GetRemote, and it inspects the URL text alone. CheckAllowedHTTPURL in config/security/securityConfig.go applies the configured pattern list and then re-checks a canonicalised form of an integer, hex or...
CVE-2026-10618 Hugo 0.93.0 through 0.165.0 Stored Cross-Site Scripting via Unescaped Code-Fence Attribute Values
Hugo's default fenced-code-block renderer writes attribute values taken from the code-fence info string into the rendered HTML without escaping them. New in markup/internal/attributes/attributes.go converts every attribute value from a byte slice to a string as it is stored, deliberately dropping...
CVE-2026-10618
Hugo versions 0.93.0 through 0.165.0 are affected by a stored cross-site scripting vulnerability in the default fenced-code-block renderer. The root cause is in markup/internal/attributes/attributes.go: the New function converts attribute values from byte slices to strings before storage, bypassi...
EUVD-2026-64776
Hugo's default fenced-code-block renderer writes attribute values taken from the code-fence info string into the rendered HTML without escaping them. New in markup/internal/attributes/attributes.go converts every attribute value from a byte slice to a string as it is stored, deliberately dropping...
CVE-2026-10582 Hugo 0.91.0 through 0.165.0 Server-Side Request Forgery via security.http.urls Lacking Destination Address Validation
Hugo's security.http.urls allowlist is the only control on outbound fetches made by resources.GetRemote, and it inspects the URL text alone. CheckAllowedHTTPURL in config/security/securityConfig.go applies the configured pattern list and then re-checks a canonicalised form of an integer, hex or...
CVE-2026-10582
Hugo versions 0.91.0 through 0.165.0 are affected by a Server-Side Request Forgery (SSRF) vulnerability in the security.http.urls allowlist. The allowlist validates only the URL text itself—checking configured patterns and canonicalised IPv4 forms—but never resolves the hostname nor inspects the ...
EUVD-2026-64775
Hugo's security.http.urls allowlist is the only control on outbound fetches made by resources.GetRemote, and it inspects the URL text alone. CheckAllowedHTTPURL in config/security/securityConfig.go applies the configured pattern list and then re-checks a canonicalised form of an integer, hex or...
Linux Distros Unpatched Vulnerability : CVE-2026-75926
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Hugo 0.161.0 placed the Node asset pipelines behind the Node.js permission model so that code running through PostCSS, Babel, or TailwindCSS could not reach the...
UBUNTU-CVE-2026-75926
Hugo 0.161.0 placed the Node asset pipelines behind the Node.js permis...
CVE-2026-75926
Hugo 0.161.0 placed the Node asset pipelines behind the Node.js permission model so that code running through PostCSS, Babel, or TailwindCSS could not reach the file system outside the project directory. Hugo 0.162.0 added tailwindcss to the AllowChildProcess default in...
CVE-2026-75926
Hugo 0.161.0 placed the Node asset pipelines behind the Node.js permission model so that code running through PostCSS, Babel, or TailwindCSS could not reach the file system outside the project directory. Hugo 0.162.0 added tailwindcss to the AllowChildProcess default in...
CVE-2026-75926 Hugo 0.162.0 to 0.164.x - Node Permission Model Bypass via Default TailwindCSS Child-Process Grant
Hugo 0.161.0 placed the Node asset pipelines behind the Node.js permission model so that code running through PostCSS, Babel, or TailwindCSS could not reach the file system outside the project directory. Hugo 0.162.0 added tailwindcss to the AllowChildProcess default in...
CVE-2026-75926
Hugo 0.161.0 placed the Node asset pipelines behind the Node.js permission model so that code running through PostCSS, Babel, or TailwindCSS could not reach the file system outside the project directory. Hugo 0.162.0 added tailwindcss to the AllowChildProcess default in...
CVE-2026-75926
Hugo 0.162.0–0.164.x added tailwindcss to the default security.exec.allow list, causing nodePermissionArgs to append --allow-child-process. A malicious tailwind.config.js executes top-level code inside the permitted Node process, calls child_process to spawn a shell, and the spawned non-Node proc...
CVE-2026-75926 Hugo 0.162.0 to 0.164.x - Node Permission Model Bypass via Default TailwindCSS Child-Process Grant
Hugo 0.161.0 placed the Node asset pipelines behind the Node.js permission model so that code running through PostCSS, Babel, or TailwindCSS could not reach the file system outside the project directory. Hugo 0.162.0 added tailwindcss to the AllowChildProcess default in...
EUVD-2026-61008
Hugo 0.161.0 placed the Node asset pipelines behind the Node.js permission model so that code running through PostCSS, Babel, or TailwindCSS could not reach the file system outside the project directory. Hugo 0.162.0 added tailwindcss to the AllowChildProcess default in...
PT-2026-77201
Name of the Vulnerable Software and Affected Versions Hugo versions 0.162.0 through 0.164.x Description A flaw exists in the Node.js permission model implementation where the tool tailwindcss is added to the default AllowChildProcess list. This allows the tailwind.config.js file to execute...
GO-2026-4815 vulnerabilities
Vulnerabilities for packages: rclone-fips, seaweedfs-operator, seaweedfs-operator-fips, mailpit-fips, mattermost, mailpit, hugo-extended, ollama, hugo-fips, ollama-fips, seaweedfs, hugo, mattermost-fips, listmonk, seaweedfs-fips, rclone...