hugo
v0.170.0The world’s fastest framework for building websites.
- Maintenance
- Active256 commits in 3 months · bus factor 1
- License
- Apache-2.0Permissive · OSI-approved
- Security
- 25 advisories22 medium, 3 low · Scorecard 5.5/10
- Supported versions
- No scheduleendoflife.date does not track this project
90.5k stars · 8.5k forks · 215 open issues · last release 2 days ago · data checked 4 hours ago
Security advisories
All advisories on GitHubThe 25 most recent advisories published by the maintainers: 22 medium, 3 low. Check the patched version against the one you run.
- mediumGHSA-4whp-jx7j-xvrmNov 13, 2026XSS via unescaped `wrapperClass` option in the `highlight` shortcode
- Affected
- >v0.140.2
- Patched in
- v0.170.0
- mediumGHSA-r48v-r4vw-h9v8Nov 13, 2026Path traversal via `_vendor/modules.txt` lets themes/modules read arbitrary files on the build host
- Affected
- >v0.56.0
- Patched in
- v0.170.0
- mediumGHSA-r73q-gwx2-fpxmOct 13, 2026Theme-defined module.replacements bypass mount restrictions and widen the Node.js read sandbox
- Affected
- >= 0.152.0
- Patched in
- v0.168.0
- mediumGHSA-3jfr-vjcq-7jvfSep 28, 2026css.Sass allowed themes to read files outside the project via the Sass compiler's import fallback
- Affected
- > v0.167.0
- Patched in
- v0.167.0
- mediumGHSA-r4xx-89rf-5424Sep 28, 2026js.Build allowed themes to read files outside the project via ESBuild's fallback resolver
- Affected
- >= v0.84.0
- Patched in
- v0.167.0
- mediumGHSA-6c8w-mpp8-9w47Sep 28, 2026Symlink in nested-mount ancestor directory of a theme exposes files outside the module
- Affected
- >=v0.162.0
- Patched in
- v0.167.0
- mediumGHSA-wcpj-vcvm-j4pgSep 28, 2026Stored XSS via unescaped heading ID in Table of Contents HTML
- Affected
- >= v0.60.0
- Patched in
- v0.167.0
- mediumGHSA-x3mx-cm49-8m9cSep 9, 2026Arbitrary file read via symlinks bypassing the Node.js permission model in css.PostCSS and other Node.js tools
- Affected
- >= v0.161.0
- Patched in
- v0.166.0
- mediumGHSA-q4xf-287f-98r8Sep 9, 2026Stored XSS via unescaped lineAnchors code block option
- Affected
- >= 0.75.0
- Patched in
- 0.166.0
- mediumGHSA-797m-7j5g-3rprSep 9, 2026Symlinked mount roots in themes/modules could read files outside the module
- Affected
- > v0.123.0
- Patched in
- v0.166.0
- mediumGHSA-pmrv-x7gp-2rjwSep 9, 2026A mixed case URL would bypass the security.http.urls IP-literal deny rule
- Affected
- >= v0.162.0
- Patched in
- v0.166.0
- mediumGHSA-pq74-mj4h-cjq2Sep 9, 2026XSS via text/org content files
- Affected
- >= v0.56.0
- Patched in
- v0.166.0
- mediumGHSA-vrm6-x8vp-mv2rAug 27, 2026TailwindCSS needs elevated Node permissions
- Affected
- > v0.43
- Patched in
- v0.165.0
- mediumGHSA-vrv5-r5rf-6v4jAug 27, 2026Symlink confinement bypass in resources.Get and os.ReadFile
- Affected
- > v0.123.0
- Patched in
- v0.165.0
- mediumCVE-2026-58404Jun 18, 2026security.http.urls deny rules bypassed by alternate IPv4 encodings (SSRF)
- Affected
- >= v0.162.0
- Patched in
- v0.163.1
- mediumCVE-2026-58403Jun 18, 2026Symlink confinement bypass in os.ReadFile
- Affected
- >= v0.123.0
- Patched in
- v0.163.1
- mediumCVE-2026-58402Jun 18, 2026XSS via unescaped code-fence language in default code block renderer
- Affected
- >= v0.60.0
- Patched in
- v0.163.3
- mediumCVE-2026-50135May 28, 2026Symlink confinement bypass in resources.Get
- Affected
- >= v0.123.0
- Patched in
- v0.162.0
- mediumCVE-2026-50134May 28, 2026security.http.urls allow-list bypass via HTTP redirects
- Affected
- >= v0.91.0
- Patched in
- v0.162.0.
- mediumCVE-2026-50133May 28, 2026XSS via text/html content files
- Affected
- < v0.162.0
- Patched in
- v0.162.0.
- mediumCVE-2026-44301Apr 28, 2026Node tool execution allows file system access outside the project directory
- Affected
- > v0.43
- Patched in
- v0.161.0
- lowCVE-2026-35166Apr 1, 2026Some markdown links not properly escaped
- Affected
- > v0.60.0
- Patched in
- v0.159.2
- lowCVE-2024-55601Dec 9, 2024Some attributes not escaped in internal templates
- Affected
- > v0.123.0
- Patched in
- v0.139.4
- lowCVE-2024-32875Apr 23, 2024Markdown title not escaped in internal render hooks
- Affected
- >= v0.123.0
- Patched in
- v0.125.3
- mediumCVE-2020-26284Dec 20, 2020Hugo can execute a binary from the current directory on Windows
- Affected
- < 0.79.1
- Patched in
- 0.79.1