Suggestions search

All statuses

Filter by:

With package: hugo

Found 13 matching suggestions

View:

Compact

Detailed

Published

Permalink CVE-2026-58403

5.9 MEDIUM

CVSS version (CVSS): 4.0
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Attack Requirement (AT): Present (P)
Privileges Required (PR): None (N)
User Interaction (UI): Active (A)
Vulnerable System Impact Confidentiality (VC): High (H)
Vulnerable System Impact Integrity (VI): None (N)
Vulnerable System Impact Availability (VA): None (N)
Subsequent System Impact Confidentiality (SC): None (N)
Subsequent System Impact Integrity (SI): None (N)
Subsequent System Impact Availability (SA): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Attack Requirement (MAT): Present (P)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): Active (A)
Modified Vulnerable System Impact Confidentiality (MVC): High (H)
Modified Vulnerable System Impact Integrity (MVI): None (N)
Modified Vulnerable System Impact Availability (MVA): None (N)
Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
Modified Subsequent System Impact Integrity (MSI): Negligible (N)
Modified Subsequent System Impact Availability (MSA): Negligible (N)
Safety (S): Not Defined (X)
Automatable (AU): Not Defined (X)
Recovery (R): Not Defined (X)
Value Density (V): Not Defined (X)
Vulnerability Response Effort (RE): Not Defined (X)
Provider Urgency (U): Not Defined (X)
Confidentiality Req. (CR): Not Defined (X)
Integrity Req. (IR): Not Defined (X)
Availability Req. (AR): Not Defined (X)
Exploit Maturity (E): Not Defined (X)

updated 2 months, 1 week ago by @LeSuisse Activity log

Created suggestion 2 months, 1 week ago
@LeSuisse ignored
2 packages
- ghosttohugo
- vscode-extensions.budparr.language-hugo-vscode
2 months, 1 week ago
@LeSuisse accepted 2 months, 1 week ago
@LeSuisse published on GitHub 2 months, 1 week ago

Hugo symlink confinement bypass in os.ReadFile

Hugo is a static site generator. From v0.123.0 through v0.163.0, Hugo's virtual filesystem is designed so that files under a mount cannot reach outside the mount tree, but a regression caused RootMappingFs.statRoot to call Stat, which follows symlinks, instead of Lstat, so a direct os.ReadFile "somefile" where somefile was a symlink pointing outside the mount would return the target's contents. This effectively let a symlink planted inside a theme or local mount read arbitrary files reachable to the user running hugo. This issue is fixed in v0.163.1.

References

https://github.com/gohugoio/hugo/security/advisories/GHSA-c3wq-j5vh-68rc x_refsource_CONFIRM
https://github.com/gohugoio/hugo/pull/15020 x_refsource_MISC
https://github.com/gohugoio/hugo/commit/cf9c8f93ca2a2838ce378f9e36d052ac2f79e229 x_refsource_MISC
https://github.com/gohugoio/hugo/releases/tag/v0.163.1 x_refsource_MISC

Affected products

hugo

==>= 0.123.0, < 0.163.1

Matching in nixpkgs

pkgs.hugo

Fast and modern static website engine

nixos-unstable 0.162.1
- nixpkgs-unstable 0.162.1
- nixos-unstable-small 0.163.2
nixos-26.05 0.161.1
- nixos-26.05-small 0.161.1
- nixpkgs-26.05-darwin 0.161.1

Ignored packages (2)

pkgs.ghosttohugo

Convert Ghost export to Hugo posts

nixos-unstable 0.5.3
- nixpkgs-unstable 0.5.3
- nixos-unstable-small 0.5.3
nixos-26.05 0.5.3
- nixos-26.05-small 0.5.3
- nixpkgs-26.05-darwin 0.5.3

pkgs.vscode-extensions.budparr.language-hugo-vscode

Adds syntax highlighting and snippets to Hugo files in VS Code

nixos-unstable 1.3.1
- nixpkgs-unstable 1.3.1
- nixos-unstable-small 1.3.1
nixos-26.05 1.3.1
- nixos-26.05-small 1.3.1
- nixpkgs-26.05-darwin 1.3.1

Needs some backports.

Fix PR for unstable: https://github.com/NixOS/nixpkgs/pull/532746

Published

Permalink CVE-2026-44301

6.2 MEDIUM

CVSS version (CVSS): 4.0
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Attack Requirement (AT): None (N)
Privileges Required (PR): Low (L)
User Interaction (UI): None (N)
Vulnerable System Impact Confidentiality (VC): High (H)
Vulnerable System Impact Integrity (VI): High (H)
Vulnerable System Impact Availability (VA): None (N)
Subsequent System Impact Confidentiality (SC): None (N)
Subsequent System Impact Integrity (SI): None (N)
Subsequent System Impact Availability (SA): None (N)
Exploit Maturity (E): Unreported (U)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Attack Requirement (MAT): None (N)
Modified Privileges Required (MPR): Low (L)
Modified User Interaction (MUI): None (N)
Modified Vulnerable System Impact Confidentiality (MVC): High (H)
Modified Vulnerable System Impact Integrity (MVI): High (H)
Modified Vulnerable System Impact Availability (MVA): None (N)
Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
Modified Subsequent System Impact Integrity (MSI): Negligible (N)
Modified Subsequent System Impact Availability (MSA): Negligible (N)
Safety (S): Not Defined (X)
Automatable (AU): Not Defined (X)
Recovery (R): Not Defined (X)
Value Density (V): Not Defined (X)
Vulnerability Response Effort (RE): Not Defined (X)
Provider Urgency (U): Not Defined (X)
Confidentiality Req. (CR): Not Defined (X)
Integrity Req. (IR): Not Defined (X)
Availability Req. (AR): Not Defined (X)

updated 4 months ago by @LeSuisse Activity log

Created suggestion 4 months ago
@LeSuisse ignored
2 packages
- ghosttohugo
- vscode-extensions.budparr.language-hugo-vscode
4 months ago
@LeSuisse accepted 4 months ago
@LeSuisse published on GitHub 4 months ago

Hugo: Node tool execution allows file system access outside the project directory

Hugo is a static site generator. From 0.43 to before 0.161.0, when building a Hugo site that uses Node-based asset pipelines (PostCSS, Babel, TailwindCSS), Hugo invoked the configured Node tools without restrictions on file system access. As a result, executing hugo against an untrusted site could allow code running through these tools to read or write files outside the project's working directory. Users who do not use PostCSS, Babel, or TailwindCSS, or who only build trusted sites, are not affected. This vulnerability is fixed in 0.161.0.

References

https://github.com/gohugoio/hugo/security/advisories/GHSA-x597-9fr4-5857 x_refsource_CONFIRM

Affected products

hugo

==>= 0.43.0, < 0.161.0

Matching in nixpkgs

pkgs.hugo

Fast and modern static website engine

nixos-unstable 0.160.1
- nixpkgs-unstable 0.161.1
- nixos-unstable-small 0.161.1

Ignored packages (2)

pkgs.ghosttohugo

Convert Ghost export to Hugo posts

nixos-unstable 0.5.3
- nixpkgs-unstable 0.5.3
- nixos-unstable-small 0.5.3

pkgs.vscode-extensions.budparr.language-hugo-vscode

Adds syntax highlighting and snippets to Hugo files in VS Code

nixos-unstable 1.3.1
- nixpkgs-unstable 1.3.1
- nixos-unstable-small 1.3.1

Package maintainers

@savtrip Sav Tripodi
@MiniHarinn Harinn <prinn.dev@pm.me>
@Frostman Sergei Lukianov <me@slukjanov.name>

Untriaged

Permalink CVE-2026-35166

created 5 months, 1 week ago Activity log

Created suggestion 5 months, 1 week ago

Hugo does not properly escape some Markdown links

Hugo is a static site generator. From 0.60.0 to before 0.159.2, links and image links in the default markdown to HTML renderer are not properly escaped. Hugo users who trust their Markdown content or have custom render hooks for links and images are not affected. This vulnerability is fixed in 0.159.2.

References

https://github.com/gohugoio/hugo/security/advisories/GHSA-mcv8-8m8x-48pg x_refsource_CONFIRM

Affected products

hugo

==>= 0.60.0, < 0.159.2

Matching in nixpkgs

pkgs.hugo

Fast and modern static website engine

nixos-unstable 0.159.0
- nixpkgs-unstable 0.159.2
- nixos-unstable-small 0.159.2

pkgs.ghosttohugo

Convert Ghost export to Hugo posts

nixos-unstable 0.5.3
- nixpkgs-unstable 0.5.3
- nixos-unstable-small 0.5.3

pkgs.vscode-extensions.budparr.language-hugo-vscode

Adds syntax highlighting and snippets to Hugo files in VS Code

nixos-unstable 1.3.1
- nixpkgs-unstable 1.3.1
- nixos-unstable-small 1.3.1

Package maintainers

@clerie clerie <nix@clerie.de>
@savtrip Sav Tripodi
@MiniHarinn Harinn <prinn.dev@pm.me>
@Frostman Sergei Lukianov <me@slukjanov.name>
@ohheyrj ohheyrj <richard@ohheyrj.co.uk>