By vendor

Gohugo vulnerabilities

Known CVEs affecting Gohugo products, prioritized by severity, with SEC.co remediation and detection guidance.

6 published vulnerabilities

• CVE-2026-58404MEDIUM 6.8

  Hugo, a popular static site generator, contains a security bypass in versions 0.162.0 through 0.163.0. The issue stems from incomplete validation of IP address formats in Hugo's security policy for remote requests. While the security policy correctly blocks requests to loopback addresses (127.0.0.1) and cloud metadata endpoints, attackers can circumvent this protection by encoding IP addresses in alternative formats—such as integers, hexadecimal, or octal notation—that the validator doesn't recognize. This allows malicious templates to make unauthorized requests to local services during the build process, potentially exposing sensitive data from cloud metadata services in CI/CD environments. The vulnerability is resolved in version 0.163.1.

• CVE-2026-58403MEDIUM 6.5

  Hugo, a popular static site generator, has a flaw in how it manages file access within mount boundaries. Versions 0.123.0 through 0.163.0 allow a symlink placed inside a theme or local mount to bypass directory restrictions and read arbitrary files from the server. An attacker who can contribute a malicious theme or alter a mounted directory could exploit this to access sensitive files that the Hugo process can read. The vulnerability requires user interaction—the user must run Hugo—but poses a meaningful confidentiality risk in collaborative or shared hosting environments. This has been patched in v0.163.1.

• CVE-2026-50133MEDIUM 6.1

  Hugo, a popular static site generator, contains a stored cross-site scripting (XSS) vulnerability in versions prior to 0.162.0. When Hugo processes HTML content files—either .html files placed in the /content directory or content generated by adapters configured with text/html media type—it outputs the body verbatim without sanitization. An attacker who can inject malicious HTML into a site's content pipeline can embed JavaScript that executes in visitors' browsers. This is particularly dangerous for sites that accept HTML content from external or user-controlled sources.

• CVE-2026-50134MEDIUM 5.8

  Hugo, a popular static site generator, contains a vulnerability in its remote resource fetching mechanism that allows attackers to bypass URL access control policies through HTTP redirects. When a Hugo site is configured to restrict which servers it can fetch content from, an attacker who controls an allowed server (or compromises its DNS) can redirect Hugo to fetch from a forbidden server instead. Hugo will follow these redirects without re-checking them against the security policy, enabling data exfiltration or content injection from otherwise blocked hosts. This affects versions 0.91.0 through 0.161.x and is resolved in 0.162.0.

• CVE-2026-50135MEDIUM 5.5

  Hugo, a popular static site generator, contains a vulnerability in versions 0.123.0 through 0.161.1 that allows arbitrary file read when a symlink is present in local theme directories. If an attacker or compromised dependency places a malicious symlink in a theme folder (such as under `themes/`), Hugo's `resources.Get` function will follow that symlink and expose files readable by the Hugo process—potentially including sensitive configuration, environment variables, or other data. This affects only locally-mounted themes; remotely sourced Go modules from GitHub are unaffected because symlinks are stripped during download. The issue stems from a regression where the file system backend began using `Stat` (which follows symlinks) instead of `Lstat` (which does not).

• CVE-2026-58402MEDIUM 5.4

  Hugo, a popular static site generator, has a vulnerability in how it renders code blocks in Markdown files. When a developer includes a code fence with a specially crafted language identifier (the part that specifies syntax highlighting, like 'python' or 'javascript'), Hugo fails to properly escape HTML characters. An attacker who can contribute Markdown content—such as through a collaborative documentation project or a compromised content repository—can inject malicious JavaScript that executes in the browsers of anyone viewing the generated website. The vulnerability affects all versions from 0.60.0 through 0.163.2; upgrading to 0.163.3 or later closes the gap.