—
GO-2026-5740
Hugo's Node tool execution allows file system access outside the project directory in github.com/gohugoio/hugo
Quick fix
GO-2026-5740 — github.com/gohugoio/hugo: upgrade to the fixed version with the command below.
go get github.com/gohugoio/hugo@v0.161.0Details
Hugo's Node tool execution allows file system access outside the project directory in github.com/gohugoio/hugo
Are you affected?
Enter the version of the package you're using.
Affected packages
Go / github.com/gohugoio/hugo
Introduced in:
0 Fixed in: 0.161.0 Fix
go get github.com/gohugoio/hugo@v0.161.0