CVE-2026-89258

Hugo (static site generator) versions after v0.123.0 and before v0.165.0 are vulnerable to a symlink confinement bypass via direct resource lookups such as resources.Get and os.ReadFile. Symlinks in parent directories were not dropped during these lookups, allowing an attacker who can place a sym...

CVE-2026-89258 Hugo before v0.165.0 Symlink Confinement Bypass via resources.Get

Hugo is a static site generator. In versions after v0.123.0 and before v0.165.0, symlinks in parent directories were not dropped during direct resource lookups, allowing path confinement to be bypassed. An attacker who can place — or who convinces a site author to place — a symlink inside a mount...

CVE-2026-89258 Hugo before v0.165.0 Symlink Confinement Bypass via resources.Get

Hugo is a static site generator. In versions after v0.123.0 and before v0.165.0, symlinks in parent directories were not dropped during direct resource lookups, allowing path confinement to be bypassed. An attacker who can place — or who convinces a site author to place — a symlink inside a mount...

CVE-2026-89258

Hugo is a static site generator. In versions after v0.123.0 and before v0.165.0, symlinks in parent directories were not dropped during direct resource lookups, allowing path confinement to be bypassed. An attacker who can place — or who convinces a site author to place — a symlink inside a mount...

EUVD-2026-76070

Hugo is a static site generator. In versions after v0.123.0 and before v0.165.0, symlinks in parent directories were not dropped during direct resource lookups, allowing path confinement to be bypassed. An attacker who can place — or who convinces a site author to place — a symlink inside a mount...

CVE-2026-89258: Improper Link Resolution Before File Access

Hugo is a static site generator. In versions after v0.123.0 and before v0.165.0, symlinks in parent directories were not dropped during direct resource lookups, allowing path confinement to be bypassed. An attacker who can place — or who convinces a site author to place — a symlink inside a mount...

Linux Distros Unpatched Vulnerability : CVE-2026-89259

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Hugo is a static site generator. From v0.161.0, Hugo executes Node tools under Node's permission model, but TailwindCSS included in the default...

PT-2026-89862

Hugo is a static site generator. From v0.161.0, Hugo executes Node tools under Node's permission model, but TailwindCSS — included in the default security.exec.allow list — requires a highly permissive configuration --allow-addons, --allow-child-process, --allow-worker. As a result, the...

CVE-2026-89259: Execution with Unnecessary Privileges

Hugo is a static site generator. From v0.161.0, Hugo executes Node tools under Node's permission model, but TailwindCSS — included in the default security.exec.allow list — requires a highly permissive configuration --allow-addons, --allow-child-process, --allow-worker. As a result, the...

PT-2026-89861

Hugo is a static site generator. In versions after v0.123.0 and before v0.165.0, symlinks in parent directories were not dropped during direct resource lookups, allowing path confinement to be bypassed. An attacker who can place — or who convinces a site author to place — a symlink inside a mount...

Linux Distros Unpatched Vulnerability : CVE-2026-89258

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Hugo is a static site generator. In versions after v0.123.0 and before v0.165.0, symlinks in parent directories were not dropped during direct resource lookups,...

CVE-2026-17057

creationtimestamp| type| source ---|---|--- 2026-09-10 06:40:02+00:00| seen| https://bsky.app/profile/hugovalters.bsky.social/post/3mv5gyfwl6u2v 2026-09-10 06:40:04+00:00| seen| https://mastodon.social/users/hugovalters/statuses/117245372129119431...

github.com/gohugoio/hugo: Hugo: Stored Cross-Site Scripting via unescaped code-fence attribute values

A flaw was found in Hugo's default fenced-code-block renderer. This vulnerability allows a remote attacker to inject arbitrary script code into the rendered HTML by providing specially crafted input in the code-fence info string. Due to improper escaping of attribute values, a malicious quote can...

github.com/gohugoio/hugo: Hugo: Arbitrary file read via symbolic link sandbox escape

A flaw was found in Hugo. This vulnerability allows information disclosure when Hugo executes build tools under the Node.js permission model, which validates only lexical file paths and fails to restrict symbolic links pointing outside the sandbox. An attacker capable of contributing content to a...

github.com/gohugoio/hugo: Hugo: Cross-site scripting via unescaped HTML in Org Mode content

A flaw was found in Hugo. When processing content files mapped to the Org Mode media type, Hugo renders raw HTML export blocks and snippets without proper escaping. An attacker who can influence or supply content files can exploit this vulnerability to conduct cross-site scripting XSS, executing...

github.com/gohugoio/hugo: Hugo: Security restriction bypass via mixed-case URL schemes

A flaw was found in Hugo. Case-sensitive validation in the URL deny rule mechanism allows an attacker to bypass access restrictions. By supplying mixed-case URL schemes when fetching remote resources, an attacker can access restricted network destinations, such as localhost or internal IP...

Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: hugo: hugo-0.166.0-0.1.hum1 aarch64, x8664 hugo-0.166.0-0.1.hum1.src src...

github.com/gohugoio/hugo: Hugo: Information disclosure via symlinked mount roots

A flaw was found in Hugo. This vulnerability enables information disclosure when building a site that includes a crafted theme or vendored module. Because Hugo fails to properly restrict symbolic links symlinks at mount roots, links pointing to directories outside the project directory are...

hugo: github.com/gohugoio/hugo: Hugo: Server-Side Request Forgery (SSRF) leading to information disclosure.

A flaw was found in Hugo. The security.http.urls allowlist, which controls outbound fetches, does not adequately validate the destination address of URLs. This vulnerability allows a remote attacker to supply a specially crafted URL that resolves to internal network resources. As a result, the Hu...

github.com/gohugoio/hugo: Hugo: Stored cross-site scripting via unescaped lineAnchors option

A flaw was found in Hugo. The syntax highlighter fails to properly sanitize the lineAnchors option, resulting in a stored Cross-Site Scripting XSS vulnerability. A remote attacker capable of submitting Markdown content can exploit this by supplying a crafted lineAnchors code block attribute. When...