hugo
- Software type
- Developer tool
- Total vulnerabilities (90 days)
- Products & ServicesProducts & Services
- SolutionsSolutions
- PricingPricing
- CompanyCompany
- ResourcesResources
en
en
As of 11/08/2026, hugo recorded 14 security vulnerabilities in the last 90 days, of which 7 are rated High or Critical. None of these vulnerabilities is actively exploited (KEV) according to CISA's catalog. CyStack recommends that organizations and individual users apply patches as soon as possible.
CyStack does not yet have sufficient official-source data to identify the latest version of hugo and determine which vulnerabilities affect that version.
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
CVE-2026-109597Hugo v0.60.0 before v0.167.0 Stored XSS via Table of Contents Heading IDsCVE-2026-109596Hugo from v0.162.0 before v0.167.0 Symlink File Disclosure via Nested Mount AncestorCVE-2026-109595Hugo v0.84.0 before v0.167.0 Path Traversal via js.Build ESBuild ResolverCVE-2026-109574Hugo before v0.167.0 Path Traversal via css.Sass Import FallbackCVE-2026-100694Hugo before 0.166.0 Cross-Site Scripting via text/org| Vulnerability | Exploitation status | Fix | Published | Severity |
|---|---|---|---|---|
CVE-2026-109597Hugo v0.60.0 before v0.167.0 Stored XSS via Table of Contents Heading IDs | Exploitation statusNot exploited | FixYes |
| SeverityMedium |
CVE-2026-109596Hugo from v0.162.0 before v0.167.0 Symlink File Disclosure via Nested Mount Ancestor | Exploitation statusNot exploited | FixYes | Published10/12/2026 | SeverityMedium |
|---|
CVE-2026-109595Hugo v0.84.0 before v0.167.0 Path Traversal via js.Build ESBuild Resolver | Exploitation statusNot exploited | FixYes | Published10/12/2026 | SeverityMedium |
|---|
CVE-2026-109574Hugo before v0.167.0 Path Traversal via css.Sass Import Fallback | Exploitation statusNot exploited | FixYes | Published10/12/2026 | SeverityMedium |
|---|
CVE-2026-100694Hugo before 0.166.0 Cross-Site Scripting via text/org | Exploitation statusNot exploited | FixYes | Published09/26/2026 | SeverityMedium |
|---|
CVE-2026-100693Hugo v0.162.0 before v0.166.0 IP-literal Deny Rule Bypass | Exploitation statusNot exploited | FixYes | Published09/26/2026 | SeverityHigh |
|---|
CVE-2026-100692Hugo before v0.166.0 Path Traversal via Symlinked Mount Roots | Exploitation statusNot exploited | FixYes | Published09/26/2026 | SeverityHigh |
|---|
CVE-2026-100691Hugo before 0.166.0 Stored XSS via lineAnchors code block option | Exploitation statusNot exploited | FixYes | Published09/26/2026 | SeverityMedium |
|---|
CVE-2026-100690Hugo v0.161.0 to v0.165.0 Arbitrary File Read via Symlinks | Exploitation statusNot exploited | FixYes | Published09/26/2026 | SeverityHigh |
|---|
CVE-2026-89259Hugo before v0.165.0 Insufficient Permission Restriction via TailwindCSS | Exploitation statusNot exploited | FixYes | Published09/11/2026 | SeverityCritical |
|---|
CVE-2026-89258Hugo before v0.165.0 Symlink Confinement Bypass via resources.Get | Exploitation statusNot exploited | FixYes | Published09/11/2026 | SeverityCritical |
|---|
CVE-2026-10618Hugo 0.93.0 through 0.165.0 Stored Cross-Site Scripting via Unescaped Code-Fence Attribute Values | Exploitation statusNot exploited | FixYes | Published08/24/2026 | SeverityMedium |
|---|
CVE-2026-10582Hugo 0.91.0 through 0.165.0 Server-Side Request Forgery via security.http.urls Lacking Destination Address Validation | Exploitation statusNot exploited | FixYes | Published08/24/2026 | SeverityHigh |
|---|
CVE-2026-75926Hugo 0.162.0 to 0.164.x - Node Permission Model Bypass via Default TailwindCSS Child-Process Grant | Exploitation statusNot exploited | FixYes | Published08/18/2026 | SeverityCritical |
|---|
CVE-2026-58404Hugo security.http.urls deny rules bypassed by alternate IPv4 encodings | Exploitation statusNot exploited | FixYes | Published07/06/2026 | SeverityMedium |
|---|
CVE-2026-58403Hugo symlink confinement bypass in os.ReadFile | Exploitation statusNot exploited | FixYes | Published07/06/2026 | SeverityMedium |
|---|
CVE-2026-58402Hugo default code block renderer XSS via unescaped code-fence language | Exploitation statusNot exploited | FixYes | Published07/06/2026 | SeverityMedium |
|---|
CVE-2026-50135Hugo: Symlink confinement bypass in resources.Get | Exploitation statusNot exploited | FixYes | Published07/06/2026 | SeverityMedium |
|---|
CVE-2026-50134Hugo: security.http.urls allow-list bypass via HTTP redirects | Exploitation statusNot exploited | FixYes | Published07/06/2026 | SeverityMedium |
|---|
CVE-2026-50133Hugo: XSS via text/html content files | Exploitation statusNot exploited | FixYes | Published07/06/2026 | SeverityMedium |
|---|
CVE-2026-44301Hugo: Node tool execution allows file system access outside the project directory | Exploitation statusNot exploited | FixYes | Published05/12/2026 | SeverityMedium |
|---|
CVE-2026-35166Hugo does not properly escape some Markdown links | Exploitation statusNot exploited | FixYes | Published04/06/2026 | SeverityMedium |
|---|
CVE-2024-55601Hugo does not escape some attributes in internal templates | Exploitation statusNot exploited | FixYes | Published12/09/2024 | SeverityMedium |
|---|
CVE-2024-32875Hugo doesn't escape markdown title in internal render hooks | Exploitation statusNot exploited | FixYes | Published04/23/2024 | SeverityMedium |
|---|
CVE-2020-26284Hugo can execute a binary from the current directory on Windows | Exploitation statusNot confirmed | FixNo | Published12/21/2020 | SeverityHigh |
|---|
25 Results | Page 1 of 1