gohugoio vulnerabilities

CVEs per yearBy the year they were published

1. 20201
2. 20242
3. 202622

Newest CVEs

• CVE-2026-109597

  Hugo v0.60.0 before v0.167.0 Stored XSS via Table of Contents Heading IDs

  gohugoio · hugo

  Medium5.1
• CVE-2026-109596

  Hugo from v0.162.0 before v0.167.0 Symlink File Disclosure via Nested Mount Ancestor

  gohugoio · hugo

  Medium6.7
• CVE-2026-109595

  Hugo v0.84.0 before v0.167.0 Path Traversal via js.Build ESBuild Resolver

  gohugoio · hugo

  Medium6.7
• CVE-2026-109574

  Hugo before v0.167.0 Path Traversal via css.Sass Import Fallback

  gohugoio · hugo

  Medium6.7
• CVE-2026-100694

  Hugo before 0.166.0 Cross-Site Scripting via text/org

  gohugoio · hugo

  Medium5.1
• CVE-2026-100693

  Hugo v0.162.0 before v0.166.0 IP-literal Deny Rule Bypass

  gohugoio · hugo

  High8.6
• CVE-2026-100692

  Hugo before v0.166.0 Path Traversal via Symlinked Mount Roots

  gohugoio · hugo

  High8.7
• CVE-2026-100691

  Hugo before 0.166.0 Stored XSS via lineAnchors code block option

  gohugoio · hugo

  Medium5.1
• CVE-2026-100690

  Hugo v0.161.0 to v0.165.0 Arbitrary File Read via Symlinks

  gohugoio · hugo

  High8.7
• CVE-2026-89259

  Hugo before v0.165.0 Insufficient Permission Restriction via TailwindCSS

  gohugoio · hugo

  Critical9.3