HIGH7.7Go
GHSA-8j34-9876-pvfq· CVE-2020-26284Hugo can execute a binary from the current directory on Windows
Modified: 9/10/2026
package
Go/github.com/gohugoio/hugo
pkg:go/github.com/gohugoio/hugo
MEDIUMGo
GHSA-c2xf-9v2r-r2rx· CVE-2024-55601, GO-2024-3314Hugo does not escape some attributes in internal templates
Modified: 12/10/2024
MEDIUMGo
GHSA-c3wq-j5vh-68rc· CVE-2026-58403, GO-2026-5309Hugo: Symlink confinement bypass in os.ReadFile
Modified: 7/24/2026
MEDIUMGo
GHSA-c54g-xjwj-8g82· CVE-2026-50133, GO-2026-5313Hugo: XSS via text/html content files
Modified: 7/7/2026
MEDIUMGo
GHSA-fw87-fv5r-9fpw· CVE-2026-50135, GO-2026-5380Hugo: Symlink confinement bypass in resources.Get
Modified: 7/7/2026
MEDIUMGo
GHSA-mcv8-8m8x-48pg· CVE-2026-35166, GO-2026-5504Hugo: Certain markdown links are not properly escaped
Modified: 7/7/2026
MEDIUM6.1Go
GHSA-ppf8-hhpp-f5hj· CVE-2024-32875, GO-2024-2747Hugo Markdown titles do not escaped in internal render hooks
Modified: 9/10/2026
MEDIUMGo
GHSA-q76j-gcg9-vxc6· CVE-2026-58402, GO-2026-5569Hugo: XSS via unescaped code-fence language in default code block renderer
Modified: 7/24/2026
HIGHGo
GHSA-r46f-3rpw-hxrv· CVE-2026-58404, GO-2026-5606Hugo: security.http.urls deny rules bypassed by alternate IPv4 encodings (SSRF)
Modified: 7/24/2026
MEDIUMGo
GHSA-vxgm-5rmg-5w8g· CVE-2026-50134, GO-2026-5681Hugo: security.http.urls allow-list bypass via HTTP redirects
Modified: 7/7/2026
MEDIUMGo
GHSA-x597-9fr4-5857· CVE-2026-44301, GO-2026-5740Hugo's Node tool execution allows file system access outside the project directory
Modified: 7/24/2026
—Go
GO-2024-2747· CVE-2024-32875, GHSA-ppf8-hhpp-f5hjHugo Markdown titles are not escaped in internal render hooks in github.com/gohugoio/hugo
Modified: 2/4/2026
—Go
GO-2024-3314· CVE-2024-55601, GHSA-c2xf-9v2r-r2rxHugo does not escape some attributes in internal templates in github.com/gohugoio/hugo
Modified: 3/3/2026
—Go
GO-2026-5309· CVE-2026-58403, GHSA-c3wq-j5vh-68rcHugo: Symlink confinement bypass in os.ReadFile in github.com/gohugoio/hugo
Modified: 7/24/2026
—Go
GO-2026-5313· CVE-2026-50133, GHSA-c54g-xjwj-8g82Hugo: XSS via text/html content files in github.com/gohugoio/hugo
Modified: 7/7/2026
—Go
GO-2026-5380· CVE-2026-50135, GHSA-fw87-fv5r-9fpwHugo: Symlink confinement bypass in resources.Get in github.com/gohugoio/hugo
Modified: 7/7/2026
—Go
GO-2026-5504· CVE-2026-35166, GHSA-mcv8-8m8x-48pgHugo: Certain markdown links are not properly escaped in github.com/gohugoio/hugo
Modified: 7/7/2026
—Go
GO-2026-5569· CVE-2026-58402, GHSA-q76j-gcg9-vxc6Hugo: XSS via unescaped code-fence language in default code block renderer in github.com/gohugoio/hugo
Modified: 7/24/2026
—Go
GO-2026-5606· CVE-2026-58404, GHSA-r46f-3rpw-hxrvHugo: security.http.urls deny rules bypassed by alternate IPv4 encodings (SSRF) in github.com/gohugoio/hugo
Modified: 7/24/2026
—Go
GO-2026-5681· CVE-2026-50134, GHSA-vxgm-5rmg-5w8gHugo: security.http.urls allow-list bypass via HTTP redirects in github.com/gohugoio/hugo
Modified: 7/7/2026
—Go
GO-2026-5740· CVE-2026-44301, GHSA-x597-9fr4-5857Hugo's Node tool execution allows file system access outside the project directory in github.com/gohugoio/hugo
Modified: 7/24/2026