EUVD-2026-61008

Hugo 0.161.0 placed the Node asset pipelines behind the Node.js permission model so that code running through PostCSS, Babel, or TailwindCSS could not reach the file system outside the project directory. Hugo 0.162.0 added tailwindcss to the AllowChildProcess default in...

CVE-2026-75926 Hugo 0.162.0 to 0.164.x - Node Permission Model Bypass via Default TailwindCSS Child-Process Grant

Hugo 0.161.0 placed the Node asset pipelines behind the Node.js permission model so that code running through PostCSS, Babel, or TailwindCSS could not reach the file system outside the project directory. Hugo 0.162.0 added tailwindcss to the AllowChildProcess default in...

CVE-2026-75926

Hugo 0.162.0–0.164.x added tailwindcss to the default security.exec.allow list, causing nodePermissionArgs to append --allow-child-process. A malicious tailwind.config.js executes top-level code inside the permitted Node process, calls child_process to spawn a shell, and the spawned non-Node proc...

PT-2026-77201

Name of the Vulnerable Software and Affected Versions Hugo versions 0.162.0 through 0.164.x Description A flaw exists in the Node.js permission model implementation where the tool tailwindcss is added to the default AllowChildProcess list. This allows the tailwind.config.js file to execute...

CVE-2026-75926: Initialization of a Resource with an Insecure Default

Hugo 0.161.0 placed the Node asset pipelines behind the Node.js permission model so that code running through PostCSS, Babel, or TailwindCSS could not reach the file system outside the project directory. Hugo 0.162.0 added tailwindcss to the AllowChildProcess default in...

GO-2026-4815 vulnerabilities

Vulnerabilities for packages: hugo-fips, mailpit, mailpit-fips, listmonk, mattermost, ollama-fips, seaweedfs-operator-fips, seaweedfs, ollama, seaweedfs-operator, mattermost-fips, seaweedfs-fips, hugo-extended, rclone, hugo, rclone-fips...

GO-2024-2747 vulnerabilities

Vulnerabilities for packages: hugo-extended...

GO-2026-5066 vulnerabilities

Vulnerabilities for packages: rclone, gitlab-workhorse-ce, seaweedfs-operator-fips, mattermost, seaweedfs, seaweedfs-operator, mattermost-fips, seaweedfs-fips, hugo, listmonk, rclone-fips...

GO-2026-5062 vulnerabilities

Vulnerabilities for packages: seaweedfs-rocksdb, hugo-fips, gitlab-workhorse-ce, mailpit, mailpit-fips, listmonk, mattermost, seaweedfs-operator-fips, seaweedfs, seaweedfs-operator, filebrowser, mattermost-fips, seaweedfs-rocksdb-fips, seaweedfs-fips, hugo-extended, rclone, hugo, rclone-fips...

GO-2024-2937 vulnerabilities

Vulnerabilities for packages: ollama, gotenberg, chainctl, hugo-extended, hugo...

GO-2024-2937 vulnerabilities

Vulnerabilities for packages: ollama, hugo-extended, hugo...

GO-2026-5066 vulnerabilities

Vulnerabilities for packages: seaweedfs, rclone, hugo, mattermost...

GO-2024-2747 vulnerabilities

Vulnerabilities for packages: hugo-extended...

GO-2026-4815 vulnerabilities

Vulnerabilities for packages: hugo-extended, hugo, seaweedfs, ollama, rclone, mailpit, mattermost...

GO-2026-5062 vulnerabilities

Vulnerabilities for packages: hugo-extended, hugo, seaweedfs, filebrowser, rclone, mailpit, mattermost...

GO-2024-2918 vulnerabilities

Vulnerabilities for packages: zarf, cosign, grafana-agent-operator, prometheus-operator, bank-vaults, velero, step-ca, druid, flyte, nuclei, py3-azure-identity, tkn, zot, argo-workflows, boring-registry, pulumi, up, hugo-extended, harbor-registry, kubescape, py3-cassandra-medusa,...

Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: hugo: hugo-0.165.0-0.1.hum1 aarch64, x8664 hugo-0.165.0-0.1.hum1.src src Security Fixes: hugo: CVE-2026-56852...

SUSE CVE-2026-44301

Hugo is a static site generator. From 0.43 to before 0.161.0, when building a Hugo site that uses Node-based asset pipelines PostCSS, Babel, TailwindCSS, Hugo invoked the configured Node tools without restrictions on file system access. As a result, executing hugo against an untrusted site could...

SUSE CVE-2026-58402

Hugo is a static site generator. From 0.60.0 until 0.163.3, Hugo's default code-block renderer wrote the Markdown code-fence language or info-string into the code class="language-..." data-lang="..." wrapper without HTML escaping. A fence info-string containing a quote and a script payload breaks...

SUSE CVE-2026-58403

Hugo is a static site generator. From v0.123.0 through v0.163.0, Hugo's virtual filesystem is designed so that files under a mount cannot reach outside the mount tree, but a regression caused RootMappingFs.statRoot to call Stat, which follows symlinks, instead of Lstat, so a direct os.ReadFile...