GO-2026-5569 Hugo: XSS via unescaped code-fence language in default code block renderer in github.com/gohugoio/hugo

Hugo: XSS via unescaped code-fence language in default code block renderer in github.com/gohugoio/hugo...

GO-2026-5740 Hugo's Node tool execution allows file system access outside the project directory in github.com/gohugoio/hugo

Hugo's Node tool execution allows file system access outside the project directory in github.com/gohugoio/hugo...

GO-2026-5606 Hugo: security.http.urls deny rules bypassed by alternate IPv4 encodings (SSRF) in github.com/gohugoio/hugo

Hugo: security.http.urls deny rules bypassed by alternate IPv4 encodings SSRF in github.com/gohugoio/hugo...

GO-2026-5309 Hugo: Symlink confinement bypass in os.ReadFile in github.com/gohugoio/hugo

Hugo: Symlink confinement bypass in os.ReadFile in github.com/gohugoio/hugo...

Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: hugo: hugo-0.164.0-0.1.2.hum1 aarch64, x8664 hugo-0.164.0-0.1.2.hum1.src src Security Fixes: hugo: CVE-2026-56852...

CVE-2026-24233

creationtimestamp| type| source ---|---|--- 2026-07-14 23:09:22+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqnda3ee6c2x 2026-07-14 23:10:46+00:00| seen| https://bsky.app/profile/hugovalters.bsky.social/post/3mqndckyvok2v 2026-07-14 23:11:04+00:00| seen|...

github.com/gohugoio/hugo: Hugo: Information disclosure via symlink confinement bypass in virtual filesystem

A flaw was found in Hugo, a static site generator. A regression in its virtual filesystem allowed a symlink symbolic link planted within a theme or local mount to bypass security restrictions. This could enable an attacker to read arbitrary files on the system where Hugo is running, leading to...

github.com/gohugoio/hugo: Hugo: Cross-site Scripting via unescaped code-fence language in default code block renderer

A flaw was found in Hugo, a static site generator. The default code-block renderer failed to properly escape Markdown code-fence language or info-strings. This vulnerability allows an attacker to inject malicious script elements into web pages, leading to Cross-site Scripting XSS. Successful...

github.com/gohugoio/hugo: Hugo: Server-Side Request Forgery (SSRF) via alternate IPv4 encodings

A flaw was found in Hugo, a static site generator. The default security policy intended to deny requests to loopback, internal, and cloud-metadata IPv4 addresses could be bypassed. This occurred because the deny rule only matched dotted-decimal notation, allowing alternate IPv4 encodings integer,...

github.com/gohugoio/hugo: Hugo: Cross-site Scripting via untrusted HTML content files

A flaw was found in Hugo, a static site generator. This vulnerability allows a remote attacker to perform stored cross-site scripting XSS by ingesting untrusted HTML content files. When a site processes these malicious files, the embedded script is executed verbatim in the rendered page,...

GO-2026-5681 Hugo: security.http.urls allow-list bypass via HTTP redirects in github.com/gohugoio/hugo

Hugo: security.http.urls allow-list bypass via HTTP redirects in github.com/gohugoio/hugo...

GO-2026-5504 Hugo: Certain markdown links are not properly escaped in github.com/gohugoio/hugo

Hugo: Certain markdown links are not properly escaped in github.com/gohugoio/hugo...

GO-2026-5313 Hugo: XSS via text/html content files in github.com/gohugoio/hugo

Hugo: XSS via text/html content files in github.com/gohugoio/hugo...

GO-2026-5380 Hugo: Symlink confinement bypass in resources.Get in github.com/gohugoio/hugo

Hugo: Symlink confinement bypass in resources.Get in github.com/gohugoio/hugo...

Linux Distros Unpatched Vulnerability : CVE-2026-58403

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Hugo is a static site generator. From v0.123.0 through v0.163.0, Hugo's virtual filesystem is designed so that files under a mount cannot reach outside the moun...

Linux Distros Unpatched Vulnerability : CVE-2026-50135

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Hugo is a static site generator. From 0.123.0 to 0.161.1, a regression made RootMappingFs.statRoot use Stat follows symlinks instead of Lstat , so a direct...

Linux Distros Unpatched Vulnerability : CVE-2026-50133

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Hugo is a static site generator. Prior to 0.162.0, Hugo accepts content files in several markup formats. Files mapped to the text/html media type typically .htm...

Linux Distros Unpatched Vulnerability : CVE-2026-58404

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Hugo is a static site generator. From v0.162.0 through v0.163.0, the default security.http.urls policy denies requests to loopback, internal, and cloud-metadata...

Linux Distros Unpatched Vulnerability : CVE-2026-58402

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Hugo is a static site generator. From 0.60.0 until 0.163.3, Hugo's default code-block renderer wrote the Markdown code-fence language or info-string into the co...

Linux Distros Unpatched Vulnerability : CVE-2026-50134

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Hugo is a static site generator. From 0.91.0 until 0.162.0, resources.GetRemote enforces security.http.urls on the URL it is called with, but it did not...