github.com/gohugoio/hugo vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

GHSA-R46F-3RPW-HXRVHighgithub.com/gohugoio/hugo: Hugo: security.http.urls deny rules bypassed by alternate IPv4 encodings (SSRF)GHSA-C3WQ-J5VH-68RCMediumgithub.com/gohugoio/hugo: Hugo: Symlink confinement bypass in os.ReadFile GHSA-Q76J-GCG9-VXC6Mediumgithub.com/gohugoio/hugo: Hugo: XSS via unescaped code-fence language in default code block renderer CVE-2026-50135Mediumgithub.com/gohugoio/hugo: Hugo: Symlink confinement bypass in resources.Get CVE-2026-50134Mediumgithub.com/gohugoio/hugo: Hugo: security.http.urls allow-list bypass via HTTP redirects CVE-2026-50133Mediumgithub.com/gohugoio/hugo: Hugo: XSS via text/html content files CVE-2026-44301Mediumgithub.com/gohugoio/hugo: Hugo's Node tool execution allows file system access outside the project directory CVE-2026-35166Mediumgithub.com/gohugoio/hugo: Hugo: Certain markdown links are not properly escaped CVE-2024-55601Mediumgithub.com/gohugoio/hugo: Hugo does not escape some attributes in internal templates CVE-2024-32875Mediumgithub.com/gohugoio/hugo: Hugo Markdown titles do not escaped in internal render hooks CVE-2020-26284Highgithub.com/gohugoio/hugo: Hugo can execute a binary from the current directory on Windows

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Get a personalized demo