en
Hugo is an open-source static site generator written in Go and maintained by the Hugo Authors and contributors. It builds websites from content, templates, themes, and related assets, with support for multilingual sites and common web publishing workflows.
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
Explore CyStack VulnScanAs of 09/15/2026, gohugoio recorded 11 security vulnerabilities in the last 90 days across 1 products, including 4 rated High or above and 0 known exploited vulnerabilities (KEV) that should be prioritized for immediate remediation.
Over the last 90 days, hugo had the most security vulnerabilities in the gohugoio ecosystem, with 11 vulnerabilities—approximately 100% of the provider's total vulnerabilities during this period.
| Vulnerability | Exploitation status | Fix | Affected product | Published | Severity |
|---|---|---|---|---|---|
CVE-2026-89259Hugo before v0.165.0 Insufficient Permission Restriction via TailwindCSS | Exploitation statusNot known exploited | FixYes | Affected producthugo | Published09/11/2026 | SeverityCritical |
CVE-2026-89258Hugo before v0.165.0 Symlink Confinement Bypass via resources.Get | Exploitation statusNot known exploited | FixYes | Affected producthugo | Published09/11/2026 | SeverityCritical |
CVE-2026-10618Hugo 0.93.0 through 0.165.0 Stored Cross-Site Scripting via Unescaped Code-Fence Attribute Values | Exploitation statusNot known exploited | FixYes | Affected producthugo | Published08/24/2026 | SeverityMedium |
CVE-2026-10582Hugo 0.91.0 through 0.165.0 Server-Side Request Forgery via security.http.urls Lacking Destination Address Validation | Exploitation statusNot known exploited | FixYes | Affected producthugo | Published08/24/2026 | SeverityHigh |
CVE-2026-75926Hugo 0.162.0 to 0.164.x - Node Permission Model Bypass via Default TailwindCSS Child-Process Grant | Exploitation statusNot known exploited | FixYes | Affected producthugo | Published08/18/2026 | SeverityCritical |
CVE-2026-50135Hugo: Symlink confinement bypass in resources.Get | Exploitation statusNot known exploited | FixYes | Affected producthugo | Published07/06/2026 | SeverityMedium |
CVE-2026-50134Hugo: security.http.urls allow-list bypass via HTTP redirects | Exploitation statusNot known exploited | FixYes | Affected producthugo | Published07/06/2026 | SeverityMedium |
CVE-2026-50133Hugo: XSS via text/html content files | Exploitation statusNot known exploited | FixYes | Affected producthugo | Published07/06/2026 | SeverityMedium |
CVE-2026-58403Hugo symlink confinement bypass in os.ReadFile | Exploitation statusNot known exploited | FixYes | Affected producthugo | Published07/06/2026 | SeverityMedium |
CVE-2026-58402Hugo default code block renderer XSS via unescaped code-fence language | Exploitation statusNot known exploited | FixYes | Affected producthugo | Published07/06/2026 | SeverityMedium |
CVE-2026-58404Hugo security.http.urls deny rules bypassed by alternate IPv4 encodings | Exploitation statusNot known exploited | FixYes | Affected producthugo | Published07/06/2026 | SeverityMedium |
CVE-2026-44301Hugo: Node tool execution allows file system access outside the project directory | Exploitation statusNot known exploited | FixYes | Affected producthugo | Published05/12/2026 | SeverityMedium |
CVE-2026-35166Hugo does not properly escape some Markdown links | Exploitation statusNot known exploited | FixYes | Affected producthugo | Published04/06/2026 | SeverityMedium |
CVE-2024-55601Hugo does not escape some attributes in internal templates | Exploitation statusNot known exploited | FixYes | Affected producthugo | Published12/09/2024 | SeverityMedium |
CVE-2024-32875Hugo doesn't escape markdown title in internal render hooks | Exploitation statusNot known exploited | FixYes | Affected producthugo | Published04/23/2024 | SeverityMedium |
CVE-2020-26284Hugo can execute a binary from the current directory on Windows | Exploitation statusNot confirmed | FixNot confirmed | Affected producthugo | Published12/21/2020 | SeverityHigh |
