Threats affecting pkg:github/gohugoio/hugo

CVE-2026-100694 is a cross-site scripting (XSS) vulnerability in the Hugo static site generator affecting versions from 0.56.0 up to but not including 0.166.0. The issue arises because content files with the text/org media type are rendered without escaping raw HTML, allowing unescaped HTML to pass through Org export blocks and @@html:...@@ snippets. This can enable an attacker who controls or influences such content files to inject malicious scripts that execute in visitors' browsers. The vulnerability is fixed in version 0.166.0 by introducing a security.allowContent allowlist that denies text/org by default, requiring explicit opt-in for Org Mode content. Only sites that process text/org content are affected, and sites fully trusting their content sources are not impacted.

CVE-2026-89259 is a critical vulnerability in the Hugo static site generator affecting versions before 0.165.0. The issue arises because TailwindCSS, included in the default security.exec.allow list, requires highly permissive Node.js execution flags that can bypass intended security restrictions. This allows Node tools invoked during a Hugo build to read and write files outside the project directory. The vulnerability was fixed in version 0.165.0 by removing TailwindCSS from the default allow list. Users not using TailwindCSS or only building trusted sites are not affected. A workaround is to define a restrictive security.exec.allow list in the hugo.toml configuration file.

CVE-2026-10618 is a medium severity cross-site scripting (XSS) vulnerability in the Hugo static site generator. The issue arises because Hugo's default fenced-code-block renderer improperly handles attribute values from code-fence info strings, writing them into HTML without proper escaping. This allows an attacker to inject malicious scripts via crafted attribute values, which execute when a user loads the affected page. The vulnerability affects Hugo versions from 0.93.0 through 0.165.0 under default configuration with code fences enabled. No official patch or fix information is provided in the available data.

CVE-2026-10582 is a Server-Side Request Forgery (SSRF) vulnerability in the Hugo static site generator. The security.http.urls allowlist only inspects URL text and does not resolve hostnames or verify the actual IP address connected to, allowing bypass via hostnames resolving to internal or cloud metadata addresses. An attacker able to supply a URL through content fields can cause the build process to fetch internal endpoints and embed the response in the generated site output.

A critical vulnerability (CVE-2026-75926) in Hugo versions 0.162.0 through 0.164.x allows arbitrary command execution due to insecure default permissions when running TailwindCSS. The vulnerability arises because TailwindCSS is launched with --allow-child-process permission, enabling code in tailwind.config.js to spawn shell processes with full user privileges. This breaks the intended Node.js permission confinement introduced in Hugo 0.161.0. The issue is fixed in Hugo 0.165.0 by removing TailwindCSS from the default allowed child process list.