Product
gohugo hugo
3 known vulnerabilities across versions
Vulnerabilities are listed by affected version. Select any CVE for the full briefing and its intelligence graph.
CVE-2026-44301
CVE-2026-35166
CVE-2020-26284
>= 0.43 and < 0.161.0
Hugo is a static site generator. From 0.43 to before 0.161.0, when building a Hugo site that uses Node-based asset pipelines (Post
>= 0.60.0 and < 0.159.2
Hugo is a static site generator. From 0.60.0 to before 0.159.2, links and image links in the default markdown to HTML renderer are
< 0.79.1
Hugo is a fast and Flexible Static Site Generator built in Go. Hugo depends on Go's
os/exec for certain features, e.g. for rende