5
CVEs
3
Critical
1
High
0
KEV
0
PoC
1
Unpatched C/H
60.0%
Patch Rate
0.3%
Avg EPSS
Severity Breakdown
CRITICAL
3
HIGH
1
MEDIUM
1
LOW
0
Monthly CVE Trend
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-75926 | Arbitrary command execution in Hugo 0.162.0 through 0.164.x occurs when the static site generator builds a project whose Tailwind configuration is supplied by an attacker-controlled theme, module, or starter template. Because these releases added tailwindcss to the AllowChildProcess default, Hugo launches the tool with --allow-child-process, and any top-level JavaScript in tailwind.config.js (loaded via require at startup) can spawn a non-Node shell that inherits none of the Node.js permission restrictions and runs with the full privileges of the build account. This is a build-time supply-chain execution flaw with no public exploit identified at time of analysis; it was reported by VulnCheck and fixed in Hugo 0.165.0. | CRITICAL | 9.3 | 0.1% | 47 |
|
| CVE-2026-89258 | Arbitrary file disclosure in the Hugo static site generator (versions after v0.123.0 and before v0.165.0) lets an attacker read files outside the intended project boundary by planting a symlink in a mounted directory. Because parent-directory symlinks were not dropped during direct resource lookups, functions like resources.Get and os.ReadFile follow the symlink and embed the target file's contents into the built site. Reported by VulnCheck; no public exploit identified at time of analysis, and this is an incomplete-fix follow-up to two prior advisories (GHSA-c3wq-j5vh-68rc and GHSA-fw87-fv5r-9fpw). | CRITICAL | 9.3 | 0.3% | 46 |
|
| CVE-2026-89259 | Sandbox/permission-restriction bypass in the Hugo static site generator (versions after v0.43, fixed in v0.165.0) lets a Node tool invoked during a build read and write files outside the project's working directory. Because TailwindCSS ships in the default security.exec.allow list and must be run with highly permissive Node flags (--allow-addons, --allow-child-process, --allow-worker), the Node permission model that was supposed to contain build tools (from the fix for GHSA-x597-9fr4-5857) is effectively neutralized. Reported by VulnCheck; no public exploit identified at time of analysis and it is not listed in CISA KEV. | CRITICAL | 9.3 | 0.4% | 46 |
|
| CVE-2026-10582 | Server-side request forgery in Hugo static site generator (versions 0.91.0 through 0.165.0) allows an attacker who can supply a URL through site content - via front-matter fields or a connected CMS - to silently fetch loopback, RFC 1918, or cloud-metadata endpoints during the build process, embedding the internal response directly into the published static output. The security.http.urls allowlist, Hugo's only guard on resources.GetRemote outbound fetches, evaluates hostname strings without performing DNS resolution, meaning any registered domain whose A record points to a private or metadata IP bypasses the policy entirely, and no dial-time hook in the HTTP client provides a second check. No public exploit code has been identified at time of analysis, but the attack requires only DNS control and content-write access, making it operationally straightforward in CI/CD-integrated deployments. | HIGH | 8.3 | 0.3% | 42 |
No patch
|
| CVE-2026-10618 | Stored cross-site scripting in Hugo's fenced-code-block renderer (versions 0.93.0 through 0.165.0) allows a low-privileged content author to inject arbitrary JavaScript into statically generated HTML pages by embedding crafted attribute values in a code-fence info string. The vulnerability arises because Hugo's `markup/internal/attributes/attributes.go` converts attribute values from byte slices to strings during storage, silently bypassing the escaping branch in `RenderAttributes` that only operates on byte slice types - contradicting the function's own documentation. Every visitor who loads an affected page executes the injected script; no public exploit identified at time of analysis, and exploitation has not been confirmed in CISA KEV. | MEDIUM | 4.8 | 0.2% | 24 |
No patch
|