Advisories · Technology
hugo.
Every CVE that names hugo among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 5.1 Medium
Hugo v0.60.0 before v0.167.0 Stored XSS via Table of Contents Heading IDs
- hugo
- Cross-site scripting (XSS)
- CVSS 6.7 Medium
Hugo from v0.162.0 before v0.167.0 Symlink File Disclosure via Nested Mount Ancestor
- hugo
- Path traversal
- CVSS 6.7 Medium
Hugo v0.84.0 before v0.167.0 Path Traversal via js.Build ESBuild Resolver
- hugo
- Path traversal
- CVSS 6.7 Medium
Hugo before v0.167.0 Path Traversal via css.Sass Import Fallback
- hugo
- Path traversal
- CVSS 5.1 Medium
Hugo before 0.166.0 Cross-Site Scripting via text/org
- hugo
- Cross-site scripting (XSS)
- CVSS 8.6 High
Hugo v0.162.0 before v0.166.0 IP-literal Deny Rule Bypass
- hugo
- CWE-178
- CVSS 8.7 High
Hugo before v0.166.0 Path Traversal via Symlinked Mount Roots
- hugo
- Path traversal
- CVSS 5.1 Medium
Hugo before 0.166.0 Stored XSS via lineAnchors code block option
- hugo
- Cross-site scripting (XSS)
- CVSS 8.7 High
Hugo v0.161.0 to v0.165.0 Arbitrary File Read via Symlinks
- hugo
- Path traversal
- CVSS 9.3 CriticalCritical · CVSS 9+
Hugo before v0.165.0 Insufficient Permission Restriction via TailwindCSS
- hugo
- Privilege escalation
- CVSS 9.3 CriticalCritical · CVSS 9+
Hugo before v0.165.0 Symlink Confinement Bypass via resources.Get
- hugo
- Path traversal
- CVSS 4.8 Medium
Hugo 0.93.0 through 0.165.0 Stored Cross-Site Scripting via Unescaped Code-Fence Attribute Values
- hugo
- Cross-site scripting (XSS)
- CVSS 8.3 High
Hugo 0.91.0 through 0.165.0 Server-Side Request Forgery via security.http.urls Lacking Destination Address Validation
- hugo
- Server-side request forgery (SSRF)
- CVSS 9.3 CriticalCritical · CVSS 9+
Hugo 0.162.0 to 0.164.x - Node Permission Model Bypass via Default TailwindCSS Child-Process Grant
- hugo
- CWE-1188