Hugo from v0.60.0 before v0.167.0 contains a stored cross-site scripting vulnerability that allows Markdown content authors to inject HTML by supplying crafted explicit heading IDs. Attackers can break out of the unescaped href attribute in .TableOfContents or .Fragments.ToHTML output to inject elements with event handlers into rendered pages.
Hugo versions from 0.162.0 up to but not including 0.167.0 contain an improper link resolution vulnerability. This flaw allows malicious themes or modules to expose files outside their intended root directory by exploiting nested-mount ancestor directories. Attackers controlling a theme can place symbolic links or NTFS junctions at virtual ancestor directories, causing Hugo to list and publish local files during site builds.
Hugo versions from 0.84.0 up to but not including 0.167.0 contain a path traversal vulnerability. This flaw allows malicious themes or modules to read files outside the project root directory by exploiting ESBuild's fallback resolver in js.Build, js.Batch, and css.Build. Attackers can use relative imports or symlinks pointing outside the project to include any file readable by the build user into the generated JavaScript or CSS output.
CVE-2026-109574 is a path traversal vulnerability in the Hugo static site generator before version 0.167.0. It affects the Sass compiler's import fallback mechanism, allowing malicious themes or modules to read files outside the project root by using crafted @import or @use statements. This can lead to unauthorized disclosure of files by compiling their contents into the published CSS output.
CVE-2026-100694 is a cross-site scripting (XSS) vulnerability in the Hugo static site generator affecting versions from 0.56.0 up to but not including 0.166.0. The issue arises because content files with the text/org media type are rendered without escaping raw HTML, allowing unescaped HTML to pass through Org export blocks and @@html:...@@ snippets. This can enable an attacker who controls or influences such content files to inject malicious scripts that execute in visitors' browsers. The vulnerability is fixed in version 0.166.0 by introducing a security.allowContent allowlist that denies text/org by default, requiring explicit opt-in for Org Mode content. Only sites that process text/org content are affected, and sites fully trusting their content sources are not impacted.
Hugo versions from 0.162.0 up to but not including 0.166.0 have a case-sensitive validation flaw in the security.http.urls IP-literal deny rule. This flaw allows attackers to bypass restrictions by using mixed-case URL schemes in resources.GetRemote calls, enabling fetching from restricted IP addresses such as localhost.
CVE-2026-100692 is a high-severity vulnerability in the Hugo static site generator affecting versions before 0.166.0. It involves improper link resolution before file access, allowing symlinks at mount roots in themes or vendored modules to expose files outside intended directories during site builds. This could lead to unauthorized reading and publishing of files outside the local theme or module paths. The issue is fixed in version 0.166.0 by treating symlinked mount roots and intermediate symlinked directories as non-existent. Modules fetched via Go modules are not affected due to their inability to contain symlinks. Users should inspect and remove symlinks in themes and vendored modules or upgrade to the fixed version.
A stored cross-site scripting (XSS) vulnerability exists in Hugo versions 0.75.0 through 0.165.x. The issue arises because the syntax highlighter does not properly escape the lineAnchors option before passing it to Chroma, which inserts the value directly into HTML attributes. This allows an attacker to inject arbitrary JavaScript into the generated pages if untrusted Markdown content is published. The vulnerability is fixed in version 0.166.0 by HTML-escaping the lineAnchors value before use.
CVE-2026-100690 is a high-severity vulnerability in Hugo versions 0.161.0 through 0.165.0 where symbolic links can escape the intended sandbox during Node.js tool execution. This allows an attacker who can contribute content to a Hugo project to create symlinks pointing outside the project directory, potentially exposing sensitive files such as /etc/passwd. The issue is fixed in version 0.166.0 by validating resolved symlink paths and failing builds that escape allowed directories.
CVE-2026-89259 is a critical vulnerability in the Hugo static site generator affecting versions before 0.165.0. The issue arises because TailwindCSS, included in the default security.exec.allow list, requires highly permissive Node.js execution flags that can bypass intended security restrictions. This allows Node tools invoked during a Hugo build to read and write files outside the project directory. The vulnerability was fixed in version 0.165.0 by removing TailwindCSS from the default allow list. Users not using TailwindCSS or only building trusted sites are not affected. A workaround is to define a restrictive security.exec.allow list in the hugo.toml configuration file.
CVE-2026-89258 is a critical vulnerability in the Hugo static site generator affecting versions before 0.165.0. It allows symlinks in parent directories to bypass path confinement during direct resource lookups, potentially exposing files outside the intended project boundaries. This can lead to unauthorized disclosure of file contents in the built site. The issue does not affect themes fetched as Go modules from GitHub or multi-directory walks. The vulnerability is fixed in version 0.165.0.
CVE-2026-10618 is a medium severity cross-site scripting (XSS) vulnerability in the Hugo static site generator. The issue arises because Hugo's default fenced-code-block renderer improperly handles attribute values from code-fence info strings, writing them into HTML without proper escaping. This allows an attacker to inject malicious scripts via crafted attribute values, which execute when a user loads the affected page. The vulnerability affects Hugo versions from 0.93.0 through 0.165.0 under default configuration with code fences enabled. No official patch or fix information is provided in the available data.
CVE-2026-10582 is a Server-Side Request Forgery (SSRF) vulnerability in the Hugo static site generator. The security.http.urls allowlist only inspects URL text and does not resolve hostnames or verify the actual IP address connected to, allowing bypass via hostnames resolving to internal or cloud metadata addresses. An attacker able to supply a URL through content fields can cause the build process to fetch internal endpoints and embed the response in the generated site output.
A critical vulnerability (CVE-2026-75926) in Hugo versions 0.162.0 through 0.164.x allows arbitrary command execution due to insecure default permissions when running TailwindCSS. The vulnerability arises because TailwindCSS is launched with --allow-child-process permission, enabling code in tailwind.config.js to spawn shell processes with full user privileges. This breaks the intended Node.js permission confinement introduced in Hugo 0.161.0. The issue is fixed in Hugo 0.165.0 by removing TailwindCSS from the default allowed child process list.
Hugo is a static site generator. From 0.123.0 to 0.161.1, a regression made RootMappingFs.statRoot use Stat (follows symlinks) instead of Lstat , so a direct resources.Get of a symlink pointing outside its mount returned the target's contents — letting a symlink planted in a local mount (e.g. a vendored themes/ theme) read arbitrary files accessible to the Hugo user. Go-module themes from GitHub (symlinks stripped) and directory walks were unaffected. Fixed in 0.162.0.
Hugo is a static site generator. From v0.162.0 through v0.163.0, the default security.http.urls policy denies requests to loopback, internal, and cloud-metadata IPv4 literals, but the deny rule only matched dotted-decimal notation, so alternate IPv4 encodings of the same addresses, including integer, hex, or octal, passed the policy. When a template passes an untrusted or data-derived URL to resources.GetRemote and the host platform uses the cgo system resolver, these encodings resolve to the blocked address, allowing build-time server-side requests to loopback and internal services, including the cloud-metadata endpoint in hosted or CI builds; the same check is reused on redirects, so the gap also applies to each redirect hop. This issue is fixed in v0.163.1.
Hugo is a static site generator. From v0.123.0 through v0.163.0, Hugo's virtual filesystem is designed so that files under a mount cannot reach outside the mount tree, but a regression caused RootMappingFs.statRoot to call Stat, which follows symlinks, instead of Lstat, so a direct os.ReadFile "somefile" where somefile was a symlink pointing outside the mount would return the target's contents. This effectively let a symlink planted inside a theme or local mount read arbitrary files reachable to the user running hugo. This issue is fixed in v0.163.1.
Hugo is a static site generator. From 0.60.0 until 0.163.3, Hugo's default code-block renderer wrote the Markdown code-fence language or info-string into the code class="language-…" data-lang="…" wrapper without HTML escaping. A fence info-string containing a quote and a script payload breaks out of the attribute and injects a live script element. This issue is fixed in 0.163.3.
Hugo is a static site generator. From 0.91.0 until 0.162.0, resources.GetRemote enforces security.http.urls on the URL it is called with, but it did not re-validate intermediate URLs on HTTP 3xx redirects. An allowed server (or an attacker controlling its DNS or response) could therefore redirect the request to a host that the policy was meant to forbid and Hugo would fetch from the redirected target. The same bypass also lifted any host-shape restriction the operator had put in place. This vulnerability is fixed in 0.162.0.
Hugo is a static site generator. Prior to 0.162.0, Hugo accepts content files in several markup formats. Files mapped to the text/html media type (typically .html files under /content, or pages produced by a content adapter that sets content.mediaType = "text/html") had their body emitted verbatim into the rendered page. A site that ingests HTML content from an untrusted source could therefore be served stored cross-site scripting. This vulnerability is fixed in 0.162.0.