CVE-2026-100691

Hugo versions 0.75.0 through 0.165.x contain a stored cross-site scripting vulnerability: the syntax highlighter does not escape the "lineAnchors" option before passing it to Chroma, which writes the value verbatim into the "id" and "href" attributes of the generated line-number markup. A crafted...

CVE-2026-100691 Hugo before 0.166.0 Stored XSS via lineAnchors code block option

Hugo versions 0.75.0 through 0.165.x contain a stored cross-site scripting vulnerability: the syntax highlighter does not escape the lineAnchors option before passing it to Chroma, which writes the value verbatim into the id and href attributes of the generated line-number markup. A crafted...

EUVD-2026-87664

Hugo versions 0.75.0 through 0.165.x contain a stored cross-site scripting vulnerability: the syntax highlighter does not escape the lineAnchors option before passing it to Chroma, which writes the value verbatim into the id and href attributes of the generated line-number markup. A crafted...

CVE-2026-100692 Hugo before v0.166.0 Path Traversal via Symlinked Mount Roots

Hugo is a static site generator. In versions after v0.123.0 and before v0.166.0, Hugo's symlink confinement checks stopped at the mount root itself, so a theme or module checked into themes/ or a vendored module could contain a symlink at a mount root for example themes/mytheme/assets -...

CVE-2026-100692

Hugo is a static site generator. In versions after v0.123.0 and before v0.166.0, Hugo's symlink confinement checks stopped at the mount root itself, so a theme or module checked into themes/ or a vendored module could contain a symlink at a mount root for example themes/mytheme/assets -...

CVE-2026-100692 Hugo before v0.166.0 Path Traversal via Symlinked Mount Roots

Hugo is a static site generator. In versions after v0.123.0 and before v0.166.0, Hugo's symlink confinement checks stopped at the mount root itself, so a theme or module checked into themes/ or a vendored module could contain a symlink at a mount root for example themes/mytheme/assets -...

EUVD-2026-87665

Hugo is a static site generator. In versions after v0.123.0 and before v0.166.0, Hugo's symlink confinement checks stopped at the mount root itself, so a theme or module checked into themes/ or a vendored module could contain a symlink at a mount root for example themes/mytheme/assets -...

CVE-2026-100692

The static site generator Hugo is vulnerable in versions after v0.123.0 and before v0.166.0 due to insufficient symlink confinement checks. A malicious theme or vendored module located in themes/ could contain a symlink at a mount root (e.g., themes/mytheme/assets -> /some/dir/outside). This a...

CVE-2026-100691

Hugo versions 0.75.0 through 0.165.x are vulnerable to a stored cross-site scripting (XSS) flaw in the syntax highlighter. The component fails to escape the lineAnchors option before passing it to Chroma , which writes the value verbatim into the id and href attributes of the generated line-numbe...

CVE-2026-100692 Hugo before v0.166.0 Path Traversal via Symlinked Mount Roots

Hugo is a static site generator. In versions after v0.123.0 and before v0.166.0, Hugo's symlink confinement checks stopped at the mount root itself, so a theme or module checked into themes/ or a vendored module could contain a symlink at a mount root for example themes/mytheme/assets -...

CVE-2026-100691

Hugo versions 0.75.0 through 0.165.x contain a stored cross-site scripting vulnerability: the syntax highlighter does not escape the lineAnchors option before passing it to Chroma, which writes the value verbatim into the id and href attributes of the generated line-number markup. A crafted...

CVE-2026-100691

Hugo versions 0.75.0 through 0.165.x contain a stored cross-site scripting vulnerability: the syntax highlighter does not escape the lineAnchors option before passing it to Chroma, which writes the value verbatim into the id and href attributes of the generated line-number markup. A crafted...

CVE-2026-100692

Hugo is a static site generator. In versions after v0.123.0 and before v0.166.0, Hugo's symlink confinement checks stopped at the mount root itself, so a theme or module checked into themes/ or a vendored module could contain a symlink at a mount root for example themes/mytheme/assets -...

CVE-2026-100692

Hugo is a static site generator. In versions after v0.123.0 and before v0.166.0, Hugo's symlink confinement checks stopped at the mount root itself, so a theme or module checked into themes/ or a vendored module could contain a symlink at a mount root for example themes/mytheme/assets -...

EUVD-2026-87663

Hugo versions from v0.161.0 through v0.165.0 run Node.js tools css.PostCSS, css.TailwindCSS, js.Babel under the Node.js permission model to restrict file system reads to the project directory and configured mounts. Because the Node.js permission model validates only the lexical path and follows...

CVE-2026-100690

Hugo versions v0.161.0 through v0.165.0 are vulnerable to an arbitrary file read due to an oversight in the Node.js permission model. While the model restricts file system reads to the project directory, it validates only the lexical path and follows symbolic links that point outside the allowed ...

CVE-2026-100690 Hugo v0.161.0 to v0.165.0 Arbitrary File Read via Symlinks

Hugo versions from v0.161.0 through v0.165.0 run Node.js tools css.PostCSS, css.TailwindCSS, js.Babel under the Node.js permission model to restrict file system reads to the project directory and configured mounts. Because the Node.js permission model validates only the lexical path and follows...

CVE-2026-100690 Hugo v0.161.0 to v0.165.0 Arbitrary File Read via Symlinks

Hugo versions from v0.161.0 through v0.165.0 run Node.js tools css.PostCSS, css.TailwindCSS, js.Babel under the Node.js permission model to restrict file system reads to the project directory and configured mounts. Because the Node.js permission model validates only the lexical path and follows...

CVE-2026-100690 Hugo v0.161.0 to v0.165.0 Arbitrary File Read via Symlinks

Hugo versions from v0.161.0 through v0.165.0 run Node.js tools css.PostCSS, css.TailwindCSS, js.Babel under the Node.js permission model to restrict file system reads to the project directory and configured mounts. Because the Node.js permission model validates only the lexical path and follows...

CVE-2026-100690

Hugo versions from v0.161.0 through v0.165.0 run Node.js tools css.PostCSS, css.TailwindCSS, js.Babel under the Node.js permission model to restrict file system reads to the project directory and configured mounts. Because the Node.js permission model validates only the lexical path and follows...