Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
8 vulnerabilities found for hugo by gohugoio
CVE-2026-35166 (GCVE-0-2026-35166)
Vulnerability from nvd – Published: 2026-04-06 17:37 – Updated: 2026-04-06 18:02
VLAI?
Title
Hugo does not properly escape some Markdown links
Summary
Hugo is a static site generator. From 0.60.0 to before 0.159.2, links and image links in the default markdown to HTML renderer are not properly escaped. Hugo users who trust their Markdown content or have custom render hooks for links and images are not affected. This vulnerability is fixed in 0.159.2.
Severity ?
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
| URL | Tags | ||||
|---|---|---|---|---|---|
|
|||||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-35166",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-04-06T18:02:26.136376Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-04-06T18:02:37.432Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "hugo",
"vendor": "gohugoio",
"versions": [
{
"status": "affected",
"version": "\u003e= 0.60.0, \u003c 0.159.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Hugo is a static site generator. From 0.60.0 to before 0.159.2, links and image links in the default markdown to HTML renderer are not properly escaped. Hugo users who trust their Markdown content or have custom render hooks for links and images are not affected. This vulnerability is fixed in 0.159.2."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-06T17:37:05.643Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/gohugoio/hugo/security/advisories/GHSA-mcv8-8m8x-48pg",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/gohugoio/hugo/security/advisories/GHSA-mcv8-8m8x-48pg"
}
],
"source": {
"advisory": "GHSA-mcv8-8m8x-48pg",
"discovery": "UNKNOWN"
},
"title": "Hugo does not properly escape some Markdown links"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-35166",
"datePublished": "2026-04-06T17:37:05.643Z",
"dateReserved": "2026-04-01T17:26:21.133Z",
"dateUpdated": "2026-04-06T18:02:37.432Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2024-55601 (GCVE-0-2024-55601)
Vulnerability from nvd – Published: 2024-12-09 21:11 – Updated: 2024-12-10 17:13
VLAI?
Title
Hugo does not escape some attributes in internal templates
Summary
Hugo is a static site generator. Starting in version 0.123.0 and prior to version 0.139.4, some HTML attributes in Markdown in the internal templates listed below not escaped in internal render hooks. Those whoa re impacted are Hugo users who do not trust their Markdown content files and are using one or more of these templates: `_default/_markup/render-link.html` from `v0.123.0`; `_default/_markup/render-image.html` from `v0.123.0`; `_default/_markup/render-table.html` from `v0.134.0`; and/or `shortcodes/youtube.html` from `v0.125.0`. This issue is patched in v0.139.4. As a workaround, one may replace an affected component with user defined templates or disable the internal templates.
Severity ?
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
| URL | Tags | |||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-55601",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-12-10T16:09:30.192956Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-12-10T17:13:48.519Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "hugo",
"vendor": "gohugoio",
"versions": [
{
"status": "affected",
"version": "\u003e= 0.123.0, \u003c 0.139.4"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Hugo is a static site generator. Starting in version 0.123.0 and prior to version 0.139.4, some HTML attributes in Markdown in the internal templates listed below not escaped in internal render hooks. Those whoa re impacted are Hugo users who do not trust their Markdown content files and are using one or more of these templates: `_default/_markup/render-link.html` from `v0.123.0`; `_default/_markup/render-image.html` from `v0.123.0`; `_default/_markup/render-table.html` from `v0.134.0`; and/or `shortcodes/youtube.html` from `v0.125.0`. This issue is patched in v0.139.4. As a workaround, one may replace an affected component with user defined templates or disable the internal templates."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-12-09T21:11:10.463Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/gohugoio/hugo/security/advisories/GHSA-c2xf-9v2r-r2rx",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/gohugoio/hugo/security/advisories/GHSA-c2xf-9v2r-r2rx"
},
{
"name": "https://github.com/gohugoio/hugo/commit/54398f8d572c689f9785d59e907fd910a23401b0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/gohugoio/hugo/commit/54398f8d572c689f9785d59e907fd910a23401b0"
},
{
"name": "https://github.com/gohugoio/hugo/releases/tag/v0.139.4",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/gohugoio/hugo/releases/tag/v0.139.4"
},
{
"name": "https://gohugo.io/getting-started/configuration-markup/#renderhooksimageenabledefault",
"tags": [
"x_refsource_MISC"
],
"url": "https://gohugo.io/getting-started/configuration-markup/#renderhooksimageenabledefault"
}
],
"source": {
"advisory": "GHSA-c2xf-9v2r-r2rx",
"discovery": "UNKNOWN"
},
"title": "Hugo does not escape some attributes in internal templates"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2024-55601",
"datePublished": "2024-12-09T21:11:10.463Z",
"dateReserved": "2024-12-09T14:22:52.524Z",
"dateUpdated": "2024-12-10T17:13:48.519Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-32875 (GCVE-0-2024-32875)
Vulnerability from nvd – Published: 2024-04-23 20:23 – Updated: 2024-08-02 02:20
VLAI?
Title
Hugo doesn't escape markdown title in internal render hooks
Summary
Hugo is a static site generator. Starting in version 0.123.0 and prior to version 0.125.3, title arguments in Markdown for links and images not escaped in internal render hooks. Hugo users who are impacted are those who have these hooks enabled and do not trust their Markdown content files. The issue is patched in v0.125.3. As a workaround, replace the templates with user defined templates or disable the internal templates.
Severity ?
6.1 (Medium)
CWE
Assigner
References
| URL | Tags | ||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:gohugo:hugo:0.123.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "hugo",
"vendor": "gohugo",
"versions": [
{
"lessThan": "0.125.3",
"status": "affected",
"version": "0.123.0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-32875",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-04-29T19:39:12.988615Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-06-04T17:51:21.525Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T02:20:35.602Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "https://github.com/gohugoio/hugo/security/advisories/GHSA-ppf8-hhpp-f5hj",
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/gohugoio/hugo/security/advisories/GHSA-ppf8-hhpp-f5hj"
},
{
"name": "https://github.com/gohugoio/hugo/releases/tag/v0.125.3",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/gohugoio/hugo/releases/tag/v0.125.3"
},
{
"name": "https://gohugo.io/getting-started/configuration-markup/#renderhooksimageenabledefault",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://gohugo.io/getting-started/configuration-markup/#renderhooksimageenabledefault"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "hugo",
"vendor": "gohugoio",
"versions": [
{
"status": "affected",
"version": "\u003e= 0.123.0, \u003c 0.125.3"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Hugo is a static site generator. Starting in version 0.123.0 and prior to version 0.125.3, title arguments in Markdown for links and images not escaped in internal render hooks. Hugo users who are impacted are those who have these hooks enabled and do not trust their Markdown content files. The issue is patched in v0.125.3. As a workaround, replace the templates with user defined templates or disable the internal templates."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-80",
"description": "CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-04-23T20:23:42.535Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/gohugoio/hugo/security/advisories/GHSA-ppf8-hhpp-f5hj",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/gohugoio/hugo/security/advisories/GHSA-ppf8-hhpp-f5hj"
},
{
"name": "https://github.com/gohugoio/hugo/releases/tag/v0.125.3",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/gohugoio/hugo/releases/tag/v0.125.3"
},
{
"name": "https://gohugo.io/getting-started/configuration-markup/#renderhooksimageenabledefault",
"tags": [
"x_refsource_MISC"
],
"url": "https://gohugo.io/getting-started/configuration-markup/#renderhooksimageenabledefault"
}
],
"source": {
"advisory": "GHSA-ppf8-hhpp-f5hj",
"discovery": "UNKNOWN"
},
"title": "Hugo doesn\u0027t escape markdown title in internal render hooks"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2024-32875",
"datePublished": "2024-04-23T20:23:42.535Z",
"dateReserved": "2024-04-19T14:07:11.229Z",
"dateUpdated": "2024-08-02T02:20:35.602Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2020-26284 (GCVE-0-2020-26284)
Vulnerability from nvd – Published: 2020-12-21 22:40 – Updated: 2024-08-04 15:56
VLAI?
Title
Hugo can execute a binary from the current directory on Windows
Summary
Hugo is a fast and Flexible Static Site Generator built in Go. Hugo depends on Go's `os/exec` for certain features, e.g. for rendering of Pandoc documents if these binaries are found in the system `%PATH%` on Windows. In Hugo before version 0.79.1, if a malicious file with the same name (`exe` or `bat`) is found in the current working directory at the time of running `hugo`, the malicious command will be invoked instead of the system one. Windows users who run `hugo` inside untrusted Hugo sites are affected. Users should upgrade to Hugo v0.79.1. Other than avoiding untrusted Hugo sites, there is no workaround.
Severity ?
7.7 (High)
CWE
- CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Assigner
References
| URL | Tags | |||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T15:56:03.976Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/gohugoio/hugo/security/advisories/GHSA-8j34-9876-pvfq"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/golang/go/issues/38736"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "hugo",
"vendor": "gohugoio",
"versions": [
{
"status": "affected",
"version": "\u003c 0.79.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Hugo is a fast and Flexible Static Site Generator built in Go. Hugo depends on Go\u0027s `os/exec` for certain features, e.g. for rendering of Pandoc documents if these binaries are found in the system `%PATH%` on Windows. In Hugo before version 0.79.1, if a malicious file with the same name (`exe` or `bat`) is found in the current working directory at the time of running `hugo`, the malicious command will be invoked instead of the system one. Windows users who run `hugo` inside untrusted Hugo sites are affected. Users should upgrade to Hugo v0.79.1. Other than avoiding untrusted Hugo sites, there is no workaround."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-12-21T22:40:15.000Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/gohugoio/hugo/security/advisories/GHSA-8j34-9876-pvfq"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/golang/go/issues/38736"
}
],
"source": {
"advisory": "GHSA-8j34-9876-pvfq",
"discovery": "UNKNOWN"
},
"title": "Hugo can execute a binary from the current directory on Windows",
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "security-advisories@github.com",
"ID": "CVE-2020-26284",
"STATE": "PUBLIC",
"TITLE": "Hugo can execute a binary from the current directory on Windows"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "hugo",
"version": {
"version_data": [
{
"version_value": "\u003c 0.79.1"
}
]
}
}
]
},
"vendor_name": "gohugoio"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Hugo is a fast and Flexible Static Site Generator built in Go. Hugo depends on Go\u0027s `os/exec` for certain features, e.g. for rendering of Pandoc documents if these binaries are found in the system `%PATH%` on Windows. In Hugo before version 0.79.1, if a malicious file with the same name (`exe` or `bat`) is found in the current working directory at the time of running `hugo`, the malicious command will be invoked instead of the system one. Windows users who run `hugo` inside untrusted Hugo sites are affected. Users should upgrade to Hugo v0.79.1. Other than avoiding untrusted Hugo sites, there is no workaround."
}
]
},
"impact": {
"cvss": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-78: Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/gohugoio/hugo/security/advisories/GHSA-8j34-9876-pvfq",
"refsource": "CONFIRM",
"url": "https://github.com/gohugoio/hugo/security/advisories/GHSA-8j34-9876-pvfq"
},
{
"name": "https://github.com/golang/go/issues/38736",
"refsource": "MISC",
"url": "https://github.com/golang/go/issues/38736"
}
]
},
"source": {
"advisory": "GHSA-8j34-9876-pvfq",
"discovery": "UNKNOWN"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2020-26284",
"datePublished": "2020-12-21T22:40:15.000Z",
"dateReserved": "2020-10-01T00:00:00.000Z",
"dateUpdated": "2024-08-04T15:56:03.976Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2026-35166 (GCVE-0-2026-35166)
Vulnerability from cvelistv5 – Published: 2026-04-06 17:37 – Updated: 2026-04-06 18:02
VLAI?
Title
Hugo does not properly escape some Markdown links
Summary
Hugo is a static site generator. From 0.60.0 to before 0.159.2, links and image links in the default markdown to HTML renderer are not properly escaped. Hugo users who trust their Markdown content or have custom render hooks for links and images are not affected. This vulnerability is fixed in 0.159.2.
Severity ?
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
| URL | Tags | ||||
|---|---|---|---|---|---|
|
|||||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-35166",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-04-06T18:02:26.136376Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-04-06T18:02:37.432Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "hugo",
"vendor": "gohugoio",
"versions": [
{
"status": "affected",
"version": "\u003e= 0.60.0, \u003c 0.159.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Hugo is a static site generator. From 0.60.0 to before 0.159.2, links and image links in the default markdown to HTML renderer are not properly escaped. Hugo users who trust their Markdown content or have custom render hooks for links and images are not affected. This vulnerability is fixed in 0.159.2."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-06T17:37:05.643Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/gohugoio/hugo/security/advisories/GHSA-mcv8-8m8x-48pg",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/gohugoio/hugo/security/advisories/GHSA-mcv8-8m8x-48pg"
}
],
"source": {
"advisory": "GHSA-mcv8-8m8x-48pg",
"discovery": "UNKNOWN"
},
"title": "Hugo does not properly escape some Markdown links"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-35166",
"datePublished": "2026-04-06T17:37:05.643Z",
"dateReserved": "2026-04-01T17:26:21.133Z",
"dateUpdated": "2026-04-06T18:02:37.432Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2024-55601 (GCVE-0-2024-55601)
Vulnerability from cvelistv5 – Published: 2024-12-09 21:11 – Updated: 2024-12-10 17:13
VLAI?
Title
Hugo does not escape some attributes in internal templates
Summary
Hugo is a static site generator. Starting in version 0.123.0 and prior to version 0.139.4, some HTML attributes in Markdown in the internal templates listed below not escaped in internal render hooks. Those whoa re impacted are Hugo users who do not trust their Markdown content files and are using one or more of these templates: `_default/_markup/render-link.html` from `v0.123.0`; `_default/_markup/render-image.html` from `v0.123.0`; `_default/_markup/render-table.html` from `v0.134.0`; and/or `shortcodes/youtube.html` from `v0.125.0`. This issue is patched in v0.139.4. As a workaround, one may replace an affected component with user defined templates or disable the internal templates.
Severity ?
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
| URL | Tags | |||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-55601",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-12-10T16:09:30.192956Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-12-10T17:13:48.519Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "hugo",
"vendor": "gohugoio",
"versions": [
{
"status": "affected",
"version": "\u003e= 0.123.0, \u003c 0.139.4"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Hugo is a static site generator. Starting in version 0.123.0 and prior to version 0.139.4, some HTML attributes in Markdown in the internal templates listed below not escaped in internal render hooks. Those whoa re impacted are Hugo users who do not trust their Markdown content files and are using one or more of these templates: `_default/_markup/render-link.html` from `v0.123.0`; `_default/_markup/render-image.html` from `v0.123.0`; `_default/_markup/render-table.html` from `v0.134.0`; and/or `shortcodes/youtube.html` from `v0.125.0`. This issue is patched in v0.139.4. As a workaround, one may replace an affected component with user defined templates or disable the internal templates."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-12-09T21:11:10.463Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/gohugoio/hugo/security/advisories/GHSA-c2xf-9v2r-r2rx",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/gohugoio/hugo/security/advisories/GHSA-c2xf-9v2r-r2rx"
},
{
"name": "https://github.com/gohugoio/hugo/commit/54398f8d572c689f9785d59e907fd910a23401b0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/gohugoio/hugo/commit/54398f8d572c689f9785d59e907fd910a23401b0"
},
{
"name": "https://github.com/gohugoio/hugo/releases/tag/v0.139.4",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/gohugoio/hugo/releases/tag/v0.139.4"
},
{
"name": "https://gohugo.io/getting-started/configuration-markup/#renderhooksimageenabledefault",
"tags": [
"x_refsource_MISC"
],
"url": "https://gohugo.io/getting-started/configuration-markup/#renderhooksimageenabledefault"
}
],
"source": {
"advisory": "GHSA-c2xf-9v2r-r2rx",
"discovery": "UNKNOWN"
},
"title": "Hugo does not escape some attributes in internal templates"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2024-55601",
"datePublished": "2024-12-09T21:11:10.463Z",
"dateReserved": "2024-12-09T14:22:52.524Z",
"dateUpdated": "2024-12-10T17:13:48.519Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-32875 (GCVE-0-2024-32875)
Vulnerability from cvelistv5 – Published: 2024-04-23 20:23 – Updated: 2024-08-02 02:20
VLAI?
Title
Hugo doesn't escape markdown title in internal render hooks
Summary
Hugo is a static site generator. Starting in version 0.123.0 and prior to version 0.125.3, title arguments in Markdown for links and images not escaped in internal render hooks. Hugo users who are impacted are those who have these hooks enabled and do not trust their Markdown content files. The issue is patched in v0.125.3. As a workaround, replace the templates with user defined templates or disable the internal templates.
Severity ?
6.1 (Medium)
CWE
Assigner
References
| URL | Tags | ||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:gohugo:hugo:0.123.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "hugo",
"vendor": "gohugo",
"versions": [
{
"lessThan": "0.125.3",
"status": "affected",
"version": "0.123.0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-32875",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-04-29T19:39:12.988615Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-06-04T17:51:21.525Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T02:20:35.602Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "https://github.com/gohugoio/hugo/security/advisories/GHSA-ppf8-hhpp-f5hj",
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/gohugoio/hugo/security/advisories/GHSA-ppf8-hhpp-f5hj"
},
{
"name": "https://github.com/gohugoio/hugo/releases/tag/v0.125.3",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/gohugoio/hugo/releases/tag/v0.125.3"
},
{
"name": "https://gohugo.io/getting-started/configuration-markup/#renderhooksimageenabledefault",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://gohugo.io/getting-started/configuration-markup/#renderhooksimageenabledefault"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "hugo",
"vendor": "gohugoio",
"versions": [
{
"status": "affected",
"version": "\u003e= 0.123.0, \u003c 0.125.3"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Hugo is a static site generator. Starting in version 0.123.0 and prior to version 0.125.3, title arguments in Markdown for links and images not escaped in internal render hooks. Hugo users who are impacted are those who have these hooks enabled and do not trust their Markdown content files. The issue is patched in v0.125.3. As a workaround, replace the templates with user defined templates or disable the internal templates."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-80",
"description": "CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-04-23T20:23:42.535Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/gohugoio/hugo/security/advisories/GHSA-ppf8-hhpp-f5hj",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/gohugoio/hugo/security/advisories/GHSA-ppf8-hhpp-f5hj"
},
{
"name": "https://github.com/gohugoio/hugo/releases/tag/v0.125.3",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/gohugoio/hugo/releases/tag/v0.125.3"
},
{
"name": "https://gohugo.io/getting-started/configuration-markup/#renderhooksimageenabledefault",
"tags": [
"x_refsource_MISC"
],
"url": "https://gohugo.io/getting-started/configuration-markup/#renderhooksimageenabledefault"
}
],
"source": {
"advisory": "GHSA-ppf8-hhpp-f5hj",
"discovery": "UNKNOWN"
},
"title": "Hugo doesn\u0027t escape markdown title in internal render hooks"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2024-32875",
"datePublished": "2024-04-23T20:23:42.535Z",
"dateReserved": "2024-04-19T14:07:11.229Z",
"dateUpdated": "2024-08-02T02:20:35.602Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2020-26284 (GCVE-0-2020-26284)
Vulnerability from cvelistv5 – Published: 2020-12-21 22:40 – Updated: 2024-08-04 15:56
VLAI?
Title
Hugo can execute a binary from the current directory on Windows
Summary
Hugo is a fast and Flexible Static Site Generator built in Go. Hugo depends on Go's `os/exec` for certain features, e.g. for rendering of Pandoc documents if these binaries are found in the system `%PATH%` on Windows. In Hugo before version 0.79.1, if a malicious file with the same name (`exe` or `bat`) is found in the current working directory at the time of running `hugo`, the malicious command will be invoked instead of the system one. Windows users who run `hugo` inside untrusted Hugo sites are affected. Users should upgrade to Hugo v0.79.1. Other than avoiding untrusted Hugo sites, there is no workaround.
Severity ?
7.7 (High)
CWE
- CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Assigner
References
| URL | Tags | |||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T15:56:03.976Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/gohugoio/hugo/security/advisories/GHSA-8j34-9876-pvfq"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/golang/go/issues/38736"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "hugo",
"vendor": "gohugoio",
"versions": [
{
"status": "affected",
"version": "\u003c 0.79.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Hugo is a fast and Flexible Static Site Generator built in Go. Hugo depends on Go\u0027s `os/exec` for certain features, e.g. for rendering of Pandoc documents if these binaries are found in the system `%PATH%` on Windows. In Hugo before version 0.79.1, if a malicious file with the same name (`exe` or `bat`) is found in the current working directory at the time of running `hugo`, the malicious command will be invoked instead of the system one. Windows users who run `hugo` inside untrusted Hugo sites are affected. Users should upgrade to Hugo v0.79.1. Other than avoiding untrusted Hugo sites, there is no workaround."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-12-21T22:40:15.000Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/gohugoio/hugo/security/advisories/GHSA-8j34-9876-pvfq"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/golang/go/issues/38736"
}
],
"source": {
"advisory": "GHSA-8j34-9876-pvfq",
"discovery": "UNKNOWN"
},
"title": "Hugo can execute a binary from the current directory on Windows",
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "security-advisories@github.com",
"ID": "CVE-2020-26284",
"STATE": "PUBLIC",
"TITLE": "Hugo can execute a binary from the current directory on Windows"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "hugo",
"version": {
"version_data": [
{
"version_value": "\u003c 0.79.1"
}
]
}
}
]
},
"vendor_name": "gohugoio"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Hugo is a fast and Flexible Static Site Generator built in Go. Hugo depends on Go\u0027s `os/exec` for certain features, e.g. for rendering of Pandoc documents if these binaries are found in the system `%PATH%` on Windows. In Hugo before version 0.79.1, if a malicious file with the same name (`exe` or `bat`) is found in the current working directory at the time of running `hugo`, the malicious command will be invoked instead of the system one. Windows users who run `hugo` inside untrusted Hugo sites are affected. Users should upgrade to Hugo v0.79.1. Other than avoiding untrusted Hugo sites, there is no workaround."
}
]
},
"impact": {
"cvss": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-78: Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/gohugoio/hugo/security/advisories/GHSA-8j34-9876-pvfq",
"refsource": "CONFIRM",
"url": "https://github.com/gohugoio/hugo/security/advisories/GHSA-8j34-9876-pvfq"
},
{
"name": "https://github.com/golang/go/issues/38736",
"refsource": "MISC",
"url": "https://github.com/golang/go/issues/38736"
}
]
},
"source": {
"advisory": "GHSA-8j34-9876-pvfq",
"discovery": "UNKNOWN"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2020-26284",
"datePublished": "2020-12-21T22:40:15.000Z",
"dateReserved": "2020-10-01T00:00:00.000Z",
"dateUpdated": "2024-08-04T15:56:03.976Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}