Gohugoio vulnerabilities
We track 7 vulnerabilities in Gohugoio products. 7 are rated high or critical, and none are known to be exploited. The most recent was published on September 26, 2026.
Latest Gohugoio vulnerabilities
- 8.4 High severity
hugo: Improper Handling of Case Sensitivity
Hugo versions from v0.162.0 before v0.166.0 contain a case-sensitive validation flaw in the security.http.urls IP-literal deny rule that allows attackers to bypass restrictions. Attackers can use mixed-case URL schemes in resources.GetRemote calls to fetch fro
- 7.5 High severity
hugo: Improper Link Resolution Before File Access
Hugo is a static site generator. In versions after v0.123.0 and before v0.166.0, Hugo's symlink confinement checks stopped at the mount root itself, so a theme or module checked into themes/ (or a vendored module) could contain a symlink at a mount root (for e
- 7.5 High severity
hugo: Improper Link Resolution Before File Access
Hugo versions from v0.161.0 through v0.165.0 run Node.js tools (css.PostCSS, css.TailwindCSS, js.Babel) under the Node.js permission model to restrict file system reads to the project directory and configured mounts. Because the Node.js permission model valida
- 9.8 Critical severity
hugo: Execution with Unnecessary Privileges
Hugo is a static site generator. From v0.161.0, Hugo executes Node tools under Node's permission model, but TailwindCSS — included in the default security.exec.allow list — requires a highly permissive configuration (--allow-addons, --allow-child-process, --al
- 7.4 High severity
hugo: Server-Side Request Forgery
Hugo's security.http.urls allowlist is the only control on outbound fetches made by resources.GetRemote, and it inspects the URL text alone. CheckAllowedHTTPURL in config/security/securityConfig.go applies the configured pattern list and then re-checks a canon
- 8.6 High severity
hugo: Initialization of a Resource with an Insecure Default
Hugo 0.161.0 placed the Node asset pipelines behind the Node.js permission model so that code running through PostCSS, Babel, or TailwindCSS could not reach the file system outside the project directory. Hugo 0.162.0 added tailwindcss to the AllowChildProcess
- 8.1 High severity
hugo: Improper Limitation of a Pathname to a Restricted Directory
Hugo is a static site generator. From 0.43 to before 0.161.0, when building a Hugo site that uses Node-based asset pipelines (PostCSS, Babel, TailwindCSS), Hugo invoked the configured Node tools without restrictions on file system access. As a result, executin