RHSA-2026:80677
Vulnerability from csaf_redhat - Published: 2026-10-12 08:50 - Updated: 2026-10-20 17:10Summary
Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update
Severity
Important
Notes
Topic: An update for Red Hat Hardened Images RPMs is now available.
Details: This update includes the following RPMs:
hugo:
* hugo-0.167.0-0.2.hum1 (aarch64, s390x, x86_64)
* hugo-0.167.0-0.2.hum1.src (src)
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in golang-protobuf. The protojson unmarshaling function can enter an infinite loop when parsing certain invalid JSON inputs, specifically when decoding messages containing Any values or when configured to discard unknown fields. A remote attacker can exploit this vulnerability by submitting specially crafted JSON payloads to cause excessive CPU utilization and hang the application, resulting in a Denial of Service (DoS).
5.9 (Medium)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Hardened Images:hugo-0:0.167.0-0.2.hum1@aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Hardened Images:hugo-0:0.167.0-0.2.hum1@s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Hardened Images:hugo-0:0.167.0-0.2.hum1@src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Hardened Images:hugo-0:0.167.0-0.2.hum1@x86_64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in Hugo. A path traversal vulnerability in the Sass stylesheet processing component allows malicious themes or modules to access files outside the intended project directory. By supplying crafted stylesheet import directives, an attacker can read sensitive local files and include their contents in the publicly generated cascading style sheets (CSS), resulting in information disclosure.
5.5 (Medium)
Affected products
Fixed
4 products, the same list as for
CVE-2024-24786
Threats
Impact
Moderate
A flaw was found in Hugo. This vulnerability allows an attacker to cause unauthorized information disclosure through path traversal when processing untrusted themes or modules. By supplying relative file paths or symbolic links that reference locations outside the project directory, an attacker can cause arbitrary files readable by the build user to be incorporated into the published output during asset compilation.
5.5 (Medium)
Affected products
Fixed
4 products, the same list as for
CVE-2024-24786
Threats
Impact
Moderate
A flaw was found in Hugo. An improper link resolution vulnerability allows an attacker who controls a malicious theme or module to disclose sensitive files outside the intended project root. By placing a symbolic link (a pointer referencing another file location) or filesystem junction within a virtual ancestor directory, an attacker can cause Hugo to read and publish local host files during the site build process.
5.5 (Medium)
Affected products
Fixed
4 products, the same list as for
CVE-2024-24786
Threats
Impact
Moderate
A flaw was found in Hugo. An attacker with permissions to author Markdown content can exploit this stored cross-site scripting (XSS) vulnerability by supplying crafted heading identifiers. When Hugo generates a table of contents or heading fragments, the unescaped attributes allow arbitrary HTML and event handlers to be injected into rendered web pages. This issue may allow malicious scripts to run in the context of a visiting user's browser session.
5.4 (Medium)
Affected products
Fixed
4 products, the same list as for
CVE-2024-24786
Threats
Impact
Moderate
References
40 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for Red Hat Hardened Images RPMs is now available.",
"title": "Topic"
},
{
"category": "general",
"text": "This update includes the following RPMs:\n\nhugo:\n * hugo-0.167.0-0.2.hum1 (aarch64, s390x, x86_64)\n * hugo-0.167.0-0.2.hum1.src (src)",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:80677",
"url": "https://access.redhat.com/errata/RHSA-2026:80677"
},
{
"category": "external",
"summary": "https://images.redhat.com/",
"url": "https://images.redhat.com/"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2024-24786",
"url": "https://access.redhat.com/security/cve/CVE-2024-24786"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/",
"url": "https://access.redhat.com/security/updates/classification/"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-109596",
"url": "https://access.redhat.com/security/cve/CVE-2026-109596"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-109595",
"url": "https://access.redhat.com/security/cve/CVE-2026-109595"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-109574",
"url": "https://access.redhat.com/security/cve/CVE-2026-109574"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-109597",
"url": "https://access.redhat.com/security/cve/CVE-2026-109597"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_80677.json"
}
],
"title": "Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update",
"tracking": {
"current_release_date": "2026-10-20T17:10:38+00:00",
"generator": {
"date": "2026-10-20T17:10:38+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.4.2"
}
},
"id": "RHSA-2026:80677",
"initial_release_date": "2026-10-12T08:50:13+00:00",
"revision_history": [
{
"date": "2026-10-12T08:50:13+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-10-13T00:57:50+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-10-20T17:10:38+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Hardened Images",
"product": {
"name": "Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:hummingbird:1"
}
}
}
],
"category": "product_family",
"name": "Red Hat Hardened Images"
},
{
"branches": [
{
"category": "product_version",
"name": "hugo-0:0.167.0-0.2.hum1@aarch64",
"product": {
"name": "hugo-0:0.167.0-0.2.hum1@aarch64",
"product_id": "hugo-0:0.167.0-0.2.hum1@aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/hugo@0.167.0-0.2.hum1?arch=aarch64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
}
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "hugo-0:0.167.0-0.2.hum1@s390x",
"product": {
"name": "hugo-0:0.167.0-0.2.hum1@s390x",
"product_id": "hugo-0:0.167.0-0.2.hum1@s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/hugo@0.167.0-0.2.hum1?arch=s390x\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-s390x-rpms"
}
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "hugo-0:0.167.0-0.2.hum1@src",
"product": {
"name": "hugo-0:0.167.0-0.2.hum1@src",
"product_id": "hugo-0:0.167.0-0.2.hum1@src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/hugo@0.167.0-0.2.hum1?arch=src\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-source-rpms"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "hugo-0:0.167.0-0.2.hum1@x86_64",
"product": {
"name": "hugo-0:0.167.0-0.2.hum1@x86_64",
"product_id": "hugo-0:0.167.0-0.2.hum1@x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/hugo@0.167.0-0.2.hum1?arch=x86_64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
}
}
}
],
"category": "architecture",
"name": "x86_64"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "hugo-0:0.167.0-0.2.hum1@aarch64 as a component of Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images:hugo-0:0.167.0-0.2.hum1@aarch64"
},
"product_reference": "hugo-0:0.167.0-0.2.hum1@aarch64",
"relates_to_product_reference": "Red Hat Hardened Images"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "hugo-0:0.167.0-0.2.hum1@s390x as a component of Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images:hugo-0:0.167.0-0.2.hum1@s390x"
},
"product_reference": "hugo-0:0.167.0-0.2.hum1@s390x",
"relates_to_product_reference": "Red Hat Hardened Images"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "hugo-0:0.167.0-0.2.hum1@src as a component of Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images:hugo-0:0.167.0-0.2.hum1@src"
},
"product_reference": "hugo-0:0.167.0-0.2.hum1@src",
"relates_to_product_reference": "Red Hat Hardened Images"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "hugo-0:0.167.0-0.2.hum1@x86_64 as a component of Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images:hugo-0:0.167.0-0.2.hum1@x86_64"
},
"product_reference": "hugo-0:0.167.0-0.2.hum1@x86_64",
"relates_to_product_reference": "Red Hat Hardened Images"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2024-24786",
"cwe": {
"id": "CWE-835",
"name": "Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)"
},
"discovery_date": "2024-03-06T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2268046"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in golang-protobuf. The protojson unmarshaling function can enter an infinite loop when parsing certain invalid JSON inputs, specifically when decoding messages containing Any values or when configured to discard unknown fields. A remote attacker can exploit this vulnerability by submitting specially crafted JSON payloads to cause excessive CPU utilization and hang the application, resulting in a Denial of Service (DoS).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "google.golang.org/protobuf: golang-protobuf: Denial of Service via infinite loop when unmarshaling invalid JSON",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as Moderate impact because exploitation is restricted to denial of service via excessive CPU and thread consumption, without compromising data confidentiality or system integrity. Red Hat services and containerized components are only exposed if they process untrusted JSON inputs into Protocol Buffer structures configured with specific parsing behaviors. Under typical deployments, the flaw does not grant privileged access or permit arbitrary code execution.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:hugo-0:0.167.0-0.2.hum1@aarch64",
"Red Hat Hardened Images:hugo-0:0.167.0-0.2.hum1@s390x",
"Red Hat Hardened Images:hugo-0:0.167.0-0.2.hum1@src",
"Red Hat Hardened Images:hugo-0:0.167.0-0.2.hum1@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2024-24786"
},
{
"category": "external",
"summary": "RHBZ#2268046",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2268046"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2024-24786",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-24786"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-24786",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-24786"
},
{
"category": "external",
"summary": "https://go.dev/cl/569356",
"url": "https://go.dev/cl/569356"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/ArQ6CDgtEjY/",
"url": "https://groups.google.com/g/golang-announce/c/ArQ6CDgtEjY/"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2024-2611",
"url": "https://pkg.go.dev/vuln/GO-2024-2611"
}
],
"release_date": "2024-03-05T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-12T08:50:13+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:hugo-0:0.167.0-0.2.hum1@aarch64",
"Red Hat Hardened Images:hugo-0:0.167.0-0.2.hum1@s390x",
"Red Hat Hardened Images:hugo-0:0.167.0-0.2.hum1@src",
"Red Hat Hardened Images:hugo-0:0.167.0-0.2.hum1@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:80677"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Hardened Images:hugo-0:0.167.0-0.2.hum1@aarch64",
"Red Hat Hardened Images:hugo-0:0.167.0-0.2.hum1@s390x",
"Red Hat Hardened Images:hugo-0:0.167.0-0.2.hum1@src",
"Red Hat Hardened Images:hugo-0:0.167.0-0.2.hum1@x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:hugo-0:0.167.0-0.2.hum1@aarch64",
"Red Hat Hardened Images:hugo-0:0.167.0-0.2.hum1@s390x",
"Red Hat Hardened Images:hugo-0:0.167.0-0.2.hum1@src",
"Red Hat Hardened Images:hugo-0:0.167.0-0.2.hum1@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "google.golang.org/protobuf: golang-protobuf: Denial of Service via infinite loop when unmarshaling invalid JSON"
},
{
"cve": "CVE-2026-109574",
"cwe": {
"id": "CWE-22",
"name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
},
"discovery_date": "2026-10-12T22:48:32.616851+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2550039"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Hugo. A path traversal vulnerability in the Sass stylesheet processing component allows malicious themes or modules to access files outside the intended project directory. By supplying crafted stylesheet import directives, an attacker can read sensitive local files and include their contents in the publicly generated cascading style sheets (CSS), resulting in information disclosure.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "hugo: Hugo: Information disclosure via Sass import path traversal",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "A flaw was found in Hugo\u0027s Sass stylesheet compilation pipeline (css.Sass). When processing themes or modules, the Sass compiler\u0027s fallback resolver fails to enforce directory confinement when handling relative, absolute, or symlinked @import or @use directives. An attacker who tricks a user or automated pipeline into compiling a site using a malicious theme can exploit path traversal to read arbitrary local host files accessible to the build user, bundling sensitive contents directly into the publicly generated CSS output.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:hugo-0:0.167.0-0.2.hum1@aarch64",
"Red Hat Hardened Images:hugo-0:0.167.0-0.2.hum1@s390x",
"Red Hat Hardened Images:hugo-0:0.167.0-0.2.hum1@src",
"Red Hat Hardened Images:hugo-0:0.167.0-0.2.hum1@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-109574"
},
{
"category": "external",
"summary": "RHBZ#2550039",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2550039"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-109574",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-109574"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-109574",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-109574"
},
{
"category": "external",
"summary": "https://github.com/gohugoio/hugo/security/advisories/GHSA-3jfr-vjcq-7jvf",
"url": "https://github.com/gohugoio/hugo/security/advisories/GHSA-3jfr-vjcq-7jvf"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/hugo-before-0.167.0-path-traversal-via-css-sass-import-fallback",
"url": "https://www.vulncheck.com/advisories/hugo-before-0.167.0-path-traversal-via-css-sass-import-fallback"
}
],
"release_date": "2026-10-12T22:21:50.021000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-12T08:50:13+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:hugo-0:0.167.0-0.2.hum1@aarch64",
"Red Hat Hardened Images:hugo-0:0.167.0-0.2.hum1@s390x",
"Red Hat Hardened Images:hugo-0:0.167.0-0.2.hum1@src",
"Red Hat Hardened Images:hugo-0:0.167.0-0.2.hum1@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:80677"
},
{
"category": "workaround",
"details": "Avoid compiling Hugo sites using untrusted themes or modules containing unverified stylesheets. When processing third-party themes, execute Hugo builds within an isolated, unprivileged container environment with minimal directory mounts.",
"product_ids": [
"Red Hat Hardened Images:hugo-0:0.167.0-0.2.hum1@aarch64",
"Red Hat Hardened Images:hugo-0:0.167.0-0.2.hum1@s390x",
"Red Hat Hardened Images:hugo-0:0.167.0-0.2.hum1@src",
"Red Hat Hardened Images:hugo-0:0.167.0-0.2.hum1@x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:hugo-0:0.167.0-0.2.hum1@aarch64",
"Red Hat Hardened Images:hugo-0:0.167.0-0.2.hum1@s390x",
"Red Hat Hardened Images:hugo-0:0.167.0-0.2.hum1@src",
"Red Hat Hardened Images:hugo-0:0.167.0-0.2.hum1@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "hugo: Hugo: Information disclosure via Sass import path traversal"
},
{
"cve": "CVE-2026-109595",
"cwe": {
"id": "CWE-22",
"name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
},
"discovery_date": "2026-10-12T22:51:06.211059+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2550056"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Hugo. This vulnerability allows an attacker to cause unauthorized information disclosure through path traversal when processing untrusted themes or modules. By supplying relative file paths or symbolic links that reference locations outside the project directory, an attacker can cause arbitrary files readable by the build user to be incorporated into the published output during asset compilation.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "hugo: Hugo: Information disclosure via path traversal during asset compilation",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "A flaw was found in Hugo\u0027s asset compilation pipeline. When compiling themes or modules, the ESBuild fallback resolver utilized in functions such as js.Build, js.Batch, and css.Build fails to prevent path traversal when handling crafted relative imports or symbolic links. An attacker who convinces a user or automated CI/CD pipeline to build a site containing a malicious theme can leak arbitrary host files readable by the build user into the published CSS or JavaScript output.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:hugo-0:0.167.0-0.2.hum1@aarch64",
"Red Hat Hardened Images:hugo-0:0.167.0-0.2.hum1@s390x",
"Red Hat Hardened Images:hugo-0:0.167.0-0.2.hum1@src",
"Red Hat Hardened Images:hugo-0:0.167.0-0.2.hum1@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-109595"
},
{
"category": "external",
"summary": "RHBZ#2550056",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2550056"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-109595",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-109595"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-109595",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-109595"
},
{
"category": "external",
"summary": "https://github.com/gohugoio/hugo/security/advisories/GHSA-r4xx-89rf-5424",
"url": "https://github.com/gohugoio/hugo/security/advisories/GHSA-r4xx-89rf-5424"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/hugo-0.84.0-before-0.167.0-path-traversal-via-js-build-esbuild-resolver",
"url": "https://www.vulncheck.com/advisories/hugo-0.84.0-before-0.167.0-path-traversal-via-js-build-esbuild-resolver"
}
],
"release_date": "2026-10-12T22:21:50.696000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-12T08:50:13+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:hugo-0:0.167.0-0.2.hum1@aarch64",
"Red Hat Hardened Images:hugo-0:0.167.0-0.2.hum1@s390x",
"Red Hat Hardened Images:hugo-0:0.167.0-0.2.hum1@src",
"Red Hat Hardened Images:hugo-0:0.167.0-0.2.hum1@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:80677"
},
{
"category": "workaround",
"details": "Avoid compiling Hugo sites with untrusted themes or third-party modules. When processing unverified assets, execute builds within an isolated, unprivileged container environment with minimal directory mounts and read-only host access.",
"product_ids": [
"Red Hat Hardened Images:hugo-0:0.167.0-0.2.hum1@aarch64",
"Red Hat Hardened Images:hugo-0:0.167.0-0.2.hum1@s390x",
"Red Hat Hardened Images:hugo-0:0.167.0-0.2.hum1@src",
"Red Hat Hardened Images:hugo-0:0.167.0-0.2.hum1@x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:hugo-0:0.167.0-0.2.hum1@aarch64",
"Red Hat Hardened Images:hugo-0:0.167.0-0.2.hum1@s390x",
"Red Hat Hardened Images:hugo-0:0.167.0-0.2.hum1@src",
"Red Hat Hardened Images:hugo-0:0.167.0-0.2.hum1@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "hugo: Hugo: Information disclosure via path traversal during asset compilation"
},
{
"cve": "CVE-2026-109596",
"cwe": {
"id": "CWE-59",
"name": "Improper Link Resolution Before File Access (\u0027Link Following\u0027)"
},
"discovery_date": "2026-10-12T22:42:32.705352+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2550016"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Hugo. An improper link resolution vulnerability allows an attacker who controls a malicious theme or module to disclose sensitive files outside the intended project root. By placing a symbolic link (a pointer referencing another file location) or filesystem junction within a virtual ancestor directory, an attacker can cause Hugo to read and publish local host files during the site build process.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "hugo: Hugo: Information disclosure via improper link resolution in nested mounts",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "A flaw was found in Hugo\u0027s virtual filesystem and link resolution logic. When compiling sites that incorporate themes or modules with nested mounts, Hugo fails to properly restrict symbolic links or filesystem junctions within virtual ancestor directories. An attacker who supplies a malicious theme can exploit resources.Match to traverse directory boundaries and publish arbitrary local host files outside the project root during site compilation, bounded by the permissions of the executing user or build container.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:hugo-0:0.167.0-0.2.hum1@aarch64",
"Red Hat Hardened Images:hugo-0:0.167.0-0.2.hum1@s390x",
"Red Hat Hardened Images:hugo-0:0.167.0-0.2.hum1@src",
"Red Hat Hardened Images:hugo-0:0.167.0-0.2.hum1@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-109596"
},
{
"category": "external",
"summary": "RHBZ#2550016",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2550016"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-109596",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-109596"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-109596",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-109596"
},
{
"category": "external",
"summary": "https://github.com/gohugoio/hugo/security/advisories/GHSA-6c8w-mpp8-9w47",
"url": "https://github.com/gohugoio/hugo/security/advisories/GHSA-6c8w-mpp8-9w47"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/hugo-from-0.162.0-before-0.167.0-symlink-file-disclosure-via-nested-mount-ancestor",
"url": "https://www.vulncheck.com/advisories/hugo-from-0.162.0-before-0.167.0-symlink-file-disclosure-via-nested-mount-ancestor"
}
],
"release_date": "2026-10-12T22:21:51.306000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-12T08:50:13+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:hugo-0:0.167.0-0.2.hum1@aarch64",
"Red Hat Hardened Images:hugo-0:0.167.0-0.2.hum1@s390x",
"Red Hat Hardened Images:hugo-0:0.167.0-0.2.hum1@src",
"Red Hat Hardened Images:hugo-0:0.167.0-0.2.hum1@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:80677"
},
{
"category": "workaround",
"details": "Avoid compiling Hugo sites with untrusted themes or modules. When processing unverified third-party themes, execute Hugo builds within an isolated, unprivileged container environment with minimal directory mounts.",
"product_ids": [
"Red Hat Hardened Images:hugo-0:0.167.0-0.2.hum1@aarch64",
"Red Hat Hardened Images:hugo-0:0.167.0-0.2.hum1@s390x",
"Red Hat Hardened Images:hugo-0:0.167.0-0.2.hum1@src",
"Red Hat Hardened Images:hugo-0:0.167.0-0.2.hum1@x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:hugo-0:0.167.0-0.2.hum1@aarch64",
"Red Hat Hardened Images:hugo-0:0.167.0-0.2.hum1@s390x",
"Red Hat Hardened Images:hugo-0:0.167.0-0.2.hum1@src",
"Red Hat Hardened Images:hugo-0:0.167.0-0.2.hum1@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "hugo: Hugo: Information disclosure via improper link resolution in nested mounts"
},
{
"cve": "CVE-2026-109597",
"cwe": {
"id": "CWE-79",
"name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
},
"discovery_date": "2026-10-12T22:55:09.510542+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2550088"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Hugo. An attacker with permissions to author Markdown content can exploit this stored cross-site scripting (XSS) vulnerability by supplying crafted heading identifiers. When Hugo generates a table of contents or heading fragments, the unescaped attributes allow arbitrary HTML and event handlers to be injected into rendered web pages. This issue may allow malicious scripts to run in the context of a visiting user\u0027s browser session.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "hugo: Hugo: Stored cross-site scripting via crafted heading identifiers",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "A flaw was found in Hugo when rendering Markdown heading identifiers into table of contents and fragment HTML structures (.TableOfContents or .Fragments.ToHTML). Hugo fails to sanitize or escape explicit heading IDs before embedding them into anchor href attributes. An attacker with permissions to author or commit Markdown content can supply crafted heading identifiers to break out of the attribute context and inject arbitrary HTML elements and event handlers, resulting in stored cross-site scripting (XSS) executing in the browser context of visiting users.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:hugo-0:0.167.0-0.2.hum1@aarch64",
"Red Hat Hardened Images:hugo-0:0.167.0-0.2.hum1@s390x",
"Red Hat Hardened Images:hugo-0:0.167.0-0.2.hum1@src",
"Red Hat Hardened Images:hugo-0:0.167.0-0.2.hum1@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-109597"
},
{
"category": "external",
"summary": "RHBZ#2550088",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2550088"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-109597",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-109597"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-109597",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-109597"
},
{
"category": "external",
"summary": "https://github.com/gohugoio/hugo/security/advisories/GHSA-wcpj-vcvm-j4pg",
"url": "https://github.com/gohugoio/hugo/security/advisories/GHSA-wcpj-vcvm-j4pg"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/hugo-0.60.0-before-0.167.0-stored-xss-via-table-of-contents-heading-ids",
"url": "https://www.vulncheck.com/advisories/hugo-0.60.0-before-0.167.0-stored-xss-via-table-of-contents-heading-ids"
}
],
"release_date": "2026-10-12T22:21:51.941000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-12T08:50:13+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:hugo-0:0.167.0-0.2.hum1@aarch64",
"Red Hat Hardened Images:hugo-0:0.167.0-0.2.hum1@s390x",
"Red Hat Hardened Images:hugo-0:0.167.0-0.2.hum1@src",
"Red Hat Hardened Images:hugo-0:0.167.0-0.2.hum1@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:80677"
},
{
"category": "workaround",
"details": "Sanitize author-submitted Markdown files or restrict untrusted contributors from defining custom explicit heading identifiers. Alternatively, avoid calling .TableOfContents or .Fragments.ToHTML within site layout templates.",
"product_ids": [
"Red Hat Hardened Images:hugo-0:0.167.0-0.2.hum1@aarch64",
"Red Hat Hardened Images:hugo-0:0.167.0-0.2.hum1@s390x",
"Red Hat Hardened Images:hugo-0:0.167.0-0.2.hum1@src",
"Red Hat Hardened Images:hugo-0:0.167.0-0.2.hum1@x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:hugo-0:0.167.0-0.2.hum1@aarch64",
"Red Hat Hardened Images:hugo-0:0.167.0-0.2.hum1@s390x",
"Red Hat Hardened Images:hugo-0:0.167.0-0.2.hum1@src",
"Red Hat Hardened Images:hugo-0:0.167.0-0.2.hum1@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "hugo: Hugo: Stored cross-site scripting via crafted heading identifiers"
}
]
}
Loading…
Loading…
Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline
Sightings and recorded dates, grouped by day · UTC
Loading timeline…
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.