{"schema_version":"2","view":"grouped","data":[{"id":29011,"cve_ids":["CVE-2026-109595"],"payload":{"kind":"advisory","title":"Hugo v0.84.0 before v0.167.0 Path Traversal via js.Build ESBuild Resolver","summary":"Hugo from v0.84.0 before v0.167.0 contains a path traversal vulnerability that allows malicious themes or modules to read files outside the project root via ESBuild's fallback resolver in js.Build, js.Batch, and css.Build. Attackers can ship relative imports or symlinks pointing outside the project to bundle any file readable by the build user into published JavaScript or CSS output.","evidence":"cve:CVE-2026-109595","products":[{"name":{"value":"hugo","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-109595","aliases":["CVE-2026-109595"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":6.7,"attackVector":"LOCAL","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","userInteraction":"ACTIVE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.5,"attackVector":"LOCAL","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","integrityImpact":"NONE","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"gohugoio","product":"hugo","versions":[{"status":"affected","version":"0.84.0","lessThan":"0.167.0","versionType":"semver"},{"status":"unaffected","version":"0.167.0","versionType":"semver"}],"packageURL":"pkg:golang/github.com/gohugoio/hugo","defaultStatus":"unaffected"}],"modified":"2026-10-15T14:06:24.829Z","provider":"cve","references":["https://github.com/gohugoio/hugo/security/advisories/GHSA-r4xx-89rf-5424","https://www.vulncheck.com/advisories/hugo-0.84.0-before-0.167.0-path-traversal-via-js-build-esbuild-resolver"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-109595","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-15T14:06:13.487314Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-15T14:06:24.829Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-12T22:21:50.696Z"}}},"related_cves":[{"value":"CVE-2026-109595","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:289d9bf0-3734-4afc-9628-12d50333b836","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-109595","advisory_id":"289d9bf0-3734-4afc-9628-12d50333b836","event_types":["advisory"],"published_at":"2026-10-25T07:48:33.395049+00:00","technologies":["core-cve","hugo"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-12T22:21:50.696+00:00","detail_url":"/advisories/advisory%3A289d9bf0-3734-4afc-9628-12d50333b836","group":{"id":"advisory:289d9bf0-3734-4afc-9628-12d50333b836","revision":1,"primary_event_id":28785,"change":"published","superseded_by":[],"changed":{"id":28785,"cve_ids":["CVE-2026-109595"],"payload":{"kind":"advisory","title":"Hugo v0.84.0 before v0.167.0 Path Traversal via js.Build ESBuild Resolver","summary":"Hugo from v0.84.0 before v0.167.0 contains a path traversal vulnerability that allows malicious themes or modules to read files outside the project root via ESBuild's fallback resolver in js.Build, js.Batch, and css.Build. Attackers can ship relative imports or symlinks pointing outside the project to bundle any file readable by the build user into published JavaScript or CSS output.","evidence":"cve:CVE-2026-109595","products":[{"name":{"value":"hugo","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-109595","aliases":["CVE-2026-109595"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":6.7,"attackVector":"LOCAL","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","userInteraction":"ACTIVE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.5,"attackVector":"LOCAL","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","integrityImpact":"NONE","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"gohugoio","product":"hugo","versions":[{"status":"affected","version":"0.84.0","lessThan":"0.167.0","versionType":"semver"},{"status":"unaffected","version":"0.167.0","versionType":"semver"}],"packageURL":"pkg:golang/github.com/gohugoio/hugo","defaultStatus":"unaffected"}],"modified":"2026-10-15T14:06:24.829Z","provider":"cve","references":["https://github.com/gohugoio/hugo/security/advisories/GHSA-r4xx-89rf-5424","https://www.vulncheck.com/advisories/hugo-0.84.0-before-0.167.0-path-traversal-via-js-build-esbuild-resolver"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-109595","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-15T14:06:13.487314Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-15T14:06:24.829Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-12T22:21:50.696Z"}}},"related_cves":[{"value":"CVE-2026-109595","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:289d9bf0-3734-4afc-9628-12d50333b836","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-109595","advisory_id":"289d9bf0-3734-4afc-9628-12d50333b836","event_types":["advisory"],"published_at":"2026-10-25T07:48:33.395049+00:00","technologies":["core-cve","hugo"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-12T22:21:50.696+00:00","detail_url":"/events/28785"},"members":[{"id":28785,"cve_ids":["CVE-2026-109595"],"payload":{"kind":"advisory","title":"Hugo v0.84.0 before v0.167.0 Path Traversal via js.Build ESBuild Resolver","summary":"Hugo from v0.84.0 before v0.167.0 contains a path traversal vulnerability that allows malicious themes or modules to read files outside the project root via ESBuild's fallback resolver in js.Build, js.Batch, and css.Build. Attackers can ship relative imports or symlinks pointing outside the project to bundle any file readable by the build user into published JavaScript or CSS output.","evidence":"cve:CVE-2026-109595","products":[{"name":{"value":"hugo","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-109595","aliases":["CVE-2026-109595"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":6.7,"attackVector":"LOCAL","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","userInteraction":"ACTIVE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.5,"attackVector":"LOCAL","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","integrityImpact":"NONE","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"gohugoio","product":"hugo","versions":[{"status":"affected","version":"0.84.0","lessThan":"0.167.0","versionType":"semver"},{"status":"unaffected","version":"0.167.0","versionType":"semver"}],"packageURL":"pkg:golang/github.com/gohugoio/hugo","defaultStatus":"unaffected"}],"modified":"2026-10-15T14:06:24.829Z","provider":"cve","references":["https://github.com/gohugoio/hugo/security/advisories/GHSA-r4xx-89rf-5424","https://www.vulncheck.com/advisories/hugo-0.84.0-before-0.167.0-path-traversal-via-js-build-esbuild-resolver"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-109595","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-15T14:06:13.487314Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-15T14:06:24.829Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-12T22:21:50.696Z"}}},"related_cves":[{"value":"CVE-2026-109595","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:289d9bf0-3734-4afc-9628-12d50333b836","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-109595","advisory_id":"289d9bf0-3734-4afc-9628-12d50333b836","event_types":["advisory"],"published_at":"2026-10-25T07:48:33.395049+00:00","technologies":["core-cve","hugo"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-12T22:21:50.696+00:00","detail_url":"/events/28785"}]}},{"id":21958,"cve_ids":["CVE-2026-109596"],"payload":{"kind":"advisory","title":"Hugo from v0.162.0 before v0.167.0 Symlink File Disclosure via Nested Mount Ancestor","summary":"Hugo from v0.162.0 before v0.167.0 contains an improper link resolution vulnerability that lets malicious themes or modules expose files outside their root via nested-mount ancestor directories. Attackers controlling a theme can place a symlink or NTFS junction at a virtual ancestor directory, causing resources.Match to list and publish local files during builds.","evidence":"cve:CVE-2026-109596","products":[{"name":{"value":"hugo","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-109596","aliases":["CVE-2026-109596"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":6.7,"attackVector":"LOCAL","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","userInteraction":"ACTIVE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.5,"attackVector":"LOCAL","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","integrityImpact":"NONE","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"gohugoio","product":"hugo","versions":[{"status":"affected","version":"0.162.0","lessThan":"0.167.0","versionType":"semver"},{"status":"unaffected","version":"0.167.0","versionType":"semver"}],"packageURL":"pkg:golang/github.com/gohugoio/hugo","defaultStatus":"unaffected"}],"modified":"2026-10-14T12:07:23.109Z","provider":"cve","references":["https://github.com/gohugoio/hugo/security/advisories/GHSA-6c8w-mpp8-9w47","https://www.vulncheck.com/advisories/hugo-from-0.162.0-before-0.167.0-symlink-file-disclosure-via-nested-mount-ancestor"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-109596","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-14T12:04:35.108374Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-14T12:07:23.109Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-12T22:21:51.306Z"}}},"related_cves":[{"value":"CVE-2026-109596","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:4bb7a48a-e67b-42c9-ba84-3b26788f03ec","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-109596","advisory_id":"4bb7a48a-e67b-42c9-ba84-3b26788f03ec","event_types":["advisory"],"published_at":"2026-10-25T05:51:31.04083+00:00","technologies":["core-cve","hugo"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-12T22:21:51.306+00:00","detail_url":"/advisories/advisory%3A4bb7a48a-e67b-42c9-ba84-3b26788f03ec","group":{"id":"advisory:4bb7a48a-e67b-42c9-ba84-3b26788f03ec","revision":1,"primary_event_id":21802,"change":"published","superseded_by":[],"changed":{"id":21802,"cve_ids":["CVE-2026-109596"],"payload":{"kind":"advisory","title":"Hugo from v0.162.0 before v0.167.0 Symlink File Disclosure via Nested Mount Ancestor","summary":"Hugo from v0.162.0 before v0.167.0 contains an improper link resolution vulnerability that lets malicious themes or modules expose files outside their root via nested-mount ancestor directories. Attackers controlling a theme can place a symlink or NTFS junction at a virtual ancestor directory, causing resources.Match to list and publish local files during builds.","evidence":"cve:CVE-2026-109596","products":[{"name":{"value":"hugo","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-109596","aliases":["CVE-2026-109596"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":6.7,"attackVector":"LOCAL","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","userInteraction":"ACTIVE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.5,"attackVector":"LOCAL","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","integrityImpact":"NONE","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"gohugoio","product":"hugo","versions":[{"status":"affected","version":"0.162.0","lessThan":"0.167.0","versionType":"semver"},{"status":"unaffected","version":"0.167.0","versionType":"semver"}],"packageURL":"pkg:golang/github.com/gohugoio/hugo","defaultStatus":"unaffected"}],"modified":"2026-10-14T12:07:23.109Z","provider":"cve","references":["https://github.com/gohugoio/hugo/security/advisories/GHSA-6c8w-mpp8-9w47","https://www.vulncheck.com/advisories/hugo-from-0.162.0-before-0.167.0-symlink-file-disclosure-via-nested-mount-ancestor"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-109596","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-14T12:04:35.108374Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-14T12:07:23.109Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-12T22:21:51.306Z"}}},"related_cves":[{"value":"CVE-2026-109596","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:4bb7a48a-e67b-42c9-ba84-3b26788f03ec","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-109596","advisory_id":"4bb7a48a-e67b-42c9-ba84-3b26788f03ec","event_types":["advisory"],"published_at":"2026-10-25T05:51:31.04083+00:00","technologies":["core-cve","hugo"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-12T22:21:51.306+00:00","detail_url":"/events/21802"},"members":[{"id":21802,"cve_ids":["CVE-2026-109596"],"payload":{"kind":"advisory","title":"Hugo from v0.162.0 before v0.167.0 Symlink File Disclosure via Nested Mount Ancestor","summary":"Hugo from v0.162.0 before v0.167.0 contains an improper link resolution vulnerability that lets malicious themes or modules expose files outside their root via nested-mount ancestor directories. Attackers controlling a theme can place a symlink or NTFS junction at a virtual ancestor directory, causing resources.Match to list and publish local files during builds.","evidence":"cve:CVE-2026-109596","products":[{"name":{"value":"hugo","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-109596","aliases":["CVE-2026-109596"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":6.7,"attackVector":"LOCAL","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","userInteraction":"ACTIVE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.5,"attackVector":"LOCAL","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","integrityImpact":"NONE","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"gohugoio","product":"hugo","versions":[{"status":"affected","version":"0.162.0","lessThan":"0.167.0","versionType":"semver"},{"status":"unaffected","version":"0.167.0","versionType":"semver"}],"packageURL":"pkg:golang/github.com/gohugoio/hugo","defaultStatus":"unaffected"}],"modified":"2026-10-14T12:07:23.109Z","provider":"cve","references":["https://github.com/gohugoio/hugo/security/advisories/GHSA-6c8w-mpp8-9w47","https://www.vulncheck.com/advisories/hugo-from-0.162.0-before-0.167.0-symlink-file-disclosure-via-nested-mount-ancestor"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-109596","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-14T12:04:35.108374Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-14T12:07:23.109Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-12T22:21:51.306Z"}}},"related_cves":[{"value":"CVE-2026-109596","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:4bb7a48a-e67b-42c9-ba84-3b26788f03ec","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-109596","advisory_id":"4bb7a48a-e67b-42c9-ba84-3b26788f03ec","event_types":["advisory"],"published_at":"2026-10-25T05:51:31.04083+00:00","technologies":["core-cve","hugo"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-12T22:21:51.306+00:00","detail_url":"/events/21802"}]}},{"id":20555,"cve_ids":["CVE-2026-109597"],"payload":{"kind":"advisory","title":"Hugo v0.60.0 before v0.167.0 Stored XSS via Table of Contents Heading IDs","summary":"Hugo from v0.60.0 before v0.167.0 contains a stored cross-site scripting vulnerability that allows Markdown content authors to inject HTML by supplying crafted explicit heading IDs. Attackers can break out of the unescaped href attribute in .TableOfContents or .Fragments.ToHTML output to inject elements with event handlers into rendered pages.","evidence":"cve:CVE-2026-109597","products":[{"name":{"value":"hugo","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-109597","aliases":["CVE-2026-109597"],"metrics":[{"format":"CVSS","cvssV4_0":{"Safety":"NOT_DEFINED","version":"4.0","Recovery":"NOT_DEFINED","baseScore":5.1,"Automatable":"NOT_DEFINED","attackVector":"NETWORK","baseSeverity":"MEDIUM","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","exploitMaturity":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","userInteraction":"PASSIVE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"LOW","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","vulnConfidentialityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"}},{"format":"CVSS","cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":5.4,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","integrityImpact":"LOW","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"LOW"}}],"affected":[{"vendor":"gohugoio","product":"hugo","versions":[{"status":"affected","version":"0.60.0","lessThan":"0.167.0","versionType":"semver"},{"status":"unaffected","version":"0.167.0","versionType":"semver"}],"packageURL":"pkg:golang/github.com/gohugoio/hugo","defaultStatus":"unaffected"}],"modified":"2026-10-13T16:46:06.110Z","provider":"cve","references":["https://github.com/gohugoio/hugo/security/advisories/GHSA-wcpj-vcvm-j4pg","https://www.vulncheck.com/advisories/hugo-0.60.0-before-0.167.0-stored-xss-via-table-of-contents-heading-ids"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-109597","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-13T15:48:36.946396Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-13T16:46:06.110Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-12T22:21:51.941Z"}}},"related_cves":[{"value":"CVE-2026-109597","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:75a495b7-41b2-4fbc-8aa3-c71fc395f692","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-109597","advisory_id":"75a495b7-41b2-4fbc-8aa3-c71fc395f692","event_types":["advisory"],"published_at":"2026-10-25T05:28:27.318118+00:00","technologies":["core-cve","hugo"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-12T22:21:51.941+00:00","detail_url":"/advisories/advisory%3A75a495b7-41b2-4fbc-8aa3-c71fc395f692","group":{"id":"advisory:75a495b7-41b2-4fbc-8aa3-c71fc395f692","revision":1,"primary_event_id":20416,"change":"published","superseded_by":[],"changed":{"id":20416,"cve_ids":["CVE-2026-109597"],"payload":{"kind":"advisory","title":"Hugo v0.60.0 before v0.167.0 Stored XSS via Table of Contents Heading IDs","summary":"Hugo from v0.60.0 before v0.167.0 contains a stored cross-site scripting vulnerability that allows Markdown content authors to inject HTML by supplying crafted explicit heading IDs. Attackers can break out of the unescaped href attribute in .TableOfContents or .Fragments.ToHTML output to inject elements with event handlers into rendered pages.","evidence":"cve:CVE-2026-109597","products":[{"name":{"value":"hugo","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-109597","aliases":["CVE-2026-109597"],"metrics":[{"format":"CVSS","cvssV4_0":{"Safety":"NOT_DEFINED","version":"4.0","Recovery":"NOT_DEFINED","baseScore":5.1,"Automatable":"NOT_DEFINED","attackVector":"NETWORK","baseSeverity":"MEDIUM","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","exploitMaturity":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","userInteraction":"PASSIVE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"LOW","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","vulnConfidentialityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"}},{"format":"CVSS","cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":5.4,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","integrityImpact":"LOW","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"LOW"}}],"affected":[{"vendor":"gohugoio","product":"hugo","versions":[{"status":"affected","version":"0.60.0","lessThan":"0.167.0","versionType":"semver"},{"status":"unaffected","version":"0.167.0","versionType":"semver"}],"packageURL":"pkg:golang/github.com/gohugoio/hugo","defaultStatus":"unaffected"}],"modified":"2026-10-13T16:46:06.110Z","provider":"cve","references":["https://github.com/gohugoio/hugo/security/advisories/GHSA-wcpj-vcvm-j4pg","https://www.vulncheck.com/advisories/hugo-0.60.0-before-0.167.0-stored-xss-via-table-of-contents-heading-ids"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-109597","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-13T15:48:36.946396Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-13T16:46:06.110Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-12T22:21:51.941Z"}}},"related_cves":[{"value":"CVE-2026-109597","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:75a495b7-41b2-4fbc-8aa3-c71fc395f692","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-109597","advisory_id":"75a495b7-41b2-4fbc-8aa3-c71fc395f692","event_types":["advisory"],"published_at":"2026-10-25T05:28:27.318118+00:00","technologies":["core-cve","hugo"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-12T22:21:51.941+00:00","detail_url":"/events/20416"},"members":[{"id":20416,"cve_ids":["CVE-2026-109597"],"payload":{"kind":"advisory","title":"Hugo v0.60.0 before v0.167.0 Stored XSS via Table of Contents Heading IDs","summary":"Hugo from v0.60.0 before v0.167.0 contains a stored cross-site scripting vulnerability that allows Markdown content authors to inject HTML by supplying crafted explicit heading IDs. Attackers can break out of the unescaped href attribute in .TableOfContents or .Fragments.ToHTML output to inject elements with event handlers into rendered pages.","evidence":"cve:CVE-2026-109597","products":[{"name":{"value":"hugo","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-109597","aliases":["CVE-2026-109597"],"metrics":[{"format":"CVSS","cvssV4_0":{"Safety":"NOT_DEFINED","version":"4.0","Recovery":"NOT_DEFINED","baseScore":5.1,"Automatable":"NOT_DEFINED","attackVector":"NETWORK","baseSeverity":"MEDIUM","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","exploitMaturity":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","userInteraction":"PASSIVE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"LOW","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","vulnConfidentialityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"}},{"format":"CVSS","cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":5.4,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","integrityImpact":"LOW","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"LOW"}}],"affected":[{"vendor":"gohugoio","product":"hugo","versions":[{"status":"affected","version":"0.60.0","lessThan":"0.167.0","versionType":"semver"},{"status":"unaffected","version":"0.167.0","versionType":"semver"}],"packageURL":"pkg:golang/github.com/gohugoio/hugo","defaultStatus":"unaffected"}],"modified":"2026-10-13T16:46:06.110Z","provider":"cve","references":["https://github.com/gohugoio/hugo/security/advisories/GHSA-wcpj-vcvm-j4pg","https://www.vulncheck.com/advisories/hugo-0.60.0-before-0.167.0-stored-xss-via-table-of-contents-heading-ids"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-109597","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-13T15:48:36.946396Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-13T16:46:06.110Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-12T22:21:51.941Z"}}},"related_cves":[{"value":"CVE-2026-109597","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:75a495b7-41b2-4fbc-8aa3-c71fc395f692","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-109597","advisory_id":"75a495b7-41b2-4fbc-8aa3-c71fc395f692","event_types":["advisory"],"published_at":"2026-10-25T05:28:27.318118+00:00","technologies":["core-cve","hugo"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-12T22:21:51.941+00:00","detail_url":"/events/20416"}]}},{"id":17234,"cve_ids":["CVE-2026-109574"],"payload":{"kind":"advisory","title":"Hugo before v0.167.0 Path Traversal via css.Sass Import Fallback","summary":"Hugo before v0.167.0 contains a path traversal vulnerability in css.Sass that allows malicious themes or modules to read files outside the project root through the Sass compiler's import fallback. Attackers can ship stylesheets with relative, absolute, or symlinked @import or @use targets to compile readable files into the published site CSS.","evidence":"cve:CVE-2026-109574","products":[{"name":{"value":"hugo","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-109574","aliases":["CVE-2026-109574"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":6.7,"attackVector":"LOCAL","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","userInteraction":"ACTIVE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.5,"attackVector":"LOCAL","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","integrityImpact":"NONE","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"gohugoio","product":"hugo","versions":[{"status":"affected","version":"0","lessThan":"0.167.0","versionType":"semver"},{"status":"unaffected","version":"0.167.0","versionType":"semver"}],"packageURL":"pkg:golang/github.com/gohugoio/hugo","defaultStatus":"unaffected"}],"modified":"2026-10-12T22:21:50.021Z","provider":"cve","references":["https://github.com/gohugoio/hugo/security/advisories/GHSA-3jfr-vjcq-7jvf","https://www.vulncheck.com/advisories/hugo-before-0.167.0-path-traversal-via-css-sass-import-fallback"],"provider_metadata":{"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-12T22:21:50.021Z"}}},"related_cves":[{"value":"CVE-2026-109574","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:81962ee8-ccb7-41f5-aaa1-929747a27def","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-109574","advisory_id":"81962ee8-ccb7-41f5-aaa1-929747a27def","event_types":["advisory"],"published_at":"2026-10-25T01:28:21.140495+00:00","technologies":["core-cve","hugo"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-12T22:21:50.021+00:00","detail_url":"/advisories/advisory%3A81962ee8-ccb7-41f5-aaa1-929747a27def","group":{"id":"advisory:81962ee8-ccb7-41f5-aaa1-929747a27def","revision":1,"primary_event_id":17123,"change":"published","superseded_by":[],"changed":{"id":17123,"cve_ids":["CVE-2026-109574"],"payload":{"kind":"advisory","title":"Hugo before v0.167.0 Path Traversal via css.Sass Import Fallback","summary":"Hugo before v0.167.0 contains a path traversal vulnerability in css.Sass that allows malicious themes or modules to read files outside the project root through the Sass compiler's import fallback. Attackers can ship stylesheets with relative, absolute, or symlinked @import or @use targets to compile readable files into the published site CSS.","evidence":"cve:CVE-2026-109574","products":[{"name":{"value":"hugo","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-109574","aliases":["CVE-2026-109574"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":6.7,"attackVector":"LOCAL","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","userInteraction":"ACTIVE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.5,"attackVector":"LOCAL","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","integrityImpact":"NONE","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"gohugoio","product":"hugo","versions":[{"status":"affected","version":"0","lessThan":"0.167.0","versionType":"semver"},{"status":"unaffected","version":"0.167.0","versionType":"semver"}],"packageURL":"pkg:golang/github.com/gohugoio/hugo","defaultStatus":"unaffected"}],"modified":"2026-10-12T22:21:50.021Z","provider":"cve","references":["https://github.com/gohugoio/hugo/security/advisories/GHSA-3jfr-vjcq-7jvf","https://www.vulncheck.com/advisories/hugo-before-0.167.0-path-traversal-via-css-sass-import-fallback"],"provider_metadata":{"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-12T22:21:50.021Z"}}},"related_cves":[{"value":"CVE-2026-109574","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:81962ee8-ccb7-41f5-aaa1-929747a27def","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-109574","advisory_id":"81962ee8-ccb7-41f5-aaa1-929747a27def","event_types":["advisory"],"published_at":"2026-10-25T01:28:21.140495+00:00","technologies":["core-cve","hugo"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-12T22:21:50.021+00:00","detail_url":"/events/17123"},"members":[{"id":17123,"cve_ids":["CVE-2026-109574"],"payload":{"kind":"advisory","title":"Hugo before v0.167.0 Path Traversal via css.Sass Import Fallback","summary":"Hugo before v0.167.0 contains a path traversal vulnerability in css.Sass that allows malicious themes or modules to read files outside the project root through the Sass compiler's import fallback. Attackers can ship stylesheets with relative, absolute, or symlinked @import or @use targets to compile readable files into the published site CSS.","evidence":"cve:CVE-2026-109574","products":[{"name":{"value":"hugo","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-109574","aliases":["CVE-2026-109574"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":6.7,"attackVector":"LOCAL","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","userInteraction":"ACTIVE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.5,"attackVector":"LOCAL","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","integrityImpact":"NONE","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"gohugoio","product":"hugo","versions":[{"status":"affected","version":"0","lessThan":"0.167.0","versionType":"semver"},{"status":"unaffected","version":"0.167.0","versionType":"semver"}],"packageURL":"pkg:golang/github.com/gohugoio/hugo","defaultStatus":"unaffected"}],"modified":"2026-10-12T22:21:50.021Z","provider":"cve","references":["https://github.com/gohugoio/hugo/security/advisories/GHSA-3jfr-vjcq-7jvf","https://www.vulncheck.com/advisories/hugo-before-0.167.0-path-traversal-via-css-sass-import-fallback"],"provider_metadata":{"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-12T22:21:50.021Z"}}},"related_cves":[{"value":"CVE-2026-109574","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:81962ee8-ccb7-41f5-aaa1-929747a27def","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-109574","advisory_id":"81962ee8-ccb7-41f5-aaa1-929747a27def","event_types":["advisory"],"published_at":"2026-10-25T01:28:21.140495+00:00","technologies":["core-cve","hugo"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-12T22:21:50.021+00:00","detail_url":"/events/17123"}]}},{"id":4622,"cve_ids":["CVE-2026-100693"],"payload":{"kind":"advisory","title":"Hugo v0.162.0 before v0.166.0 IP-literal Deny Rule Bypass","summary":"Hugo versions from v0.162.0 before v0.166.0 contain a case-sensitive validation flaw in the security.http.urls IP-literal deny rule that allows attackers to bypass restrictions. Attackers can use mixed-case URL schemes in resources.GetRemote calls to fetch from restricted IP addresses like localhost.","evidence":"cve:CVE-2026-100693","products":[{"name":{"value":"hugo","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-100693","aliases":["CVE-2026-100693"],"metrics":[{"format":"CVSS","cvssV4_0":{"Safety":"NOT_DEFINED","version":"4.0","Recovery":"NOT_DEFINED","baseScore":8.6,"Automatable":"NOT_DEFINED","attackVector":"LOCAL","baseSeverity":"HIGH","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","exploitMaturity":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":8.4,"attackVector":"LOCAL","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"gohugoio","product":"hugo","versions":[{"status":"affected","version":"0.162.0","lessThan":"0.166.0","versionType":"semver"},{"status":"unaffected","version":"0.166.0","versionType":"semver"}],"packageURL":"pkg:golang/github.com/gohugoio/hugo","defaultStatus":"unaffected"}],"modified":"2026-09-30T17:05:28.149Z","provider":"cve","references":["https://github.com/gohugoio/hugo/security/advisories/GHSA-pmrv-x7gp-2rjw","https://www.vulncheck.com/advisories/hugo-0.162.0-before-0.166.0-ip-literal-deny-rule-bypass"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-100693","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-09-30T17:05:19.378001Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-30T17:05:28.149Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-09-26T13:23:51.556Z"}}},"related_cves":[{"value":"CVE-2026-100693","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:7917208a-1693-41c5-9a4e-92677ac27ae3","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-100693","advisory_id":"7917208a-1693-41c5-9a4e-92677ac27ae3","event_types":["advisory"],"published_at":"2026-10-24T21:55:36.76161+00:00","technologies":["core-cve","hugo"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-26T13:23:51.556+00:00","detail_url":"/advisories/advisory%3A7917208a-1693-41c5-9a4e-92677ac27ae3","group":{"id":"advisory:7917208a-1693-41c5-9a4e-92677ac27ae3","revision":1,"primary_event_id":4640,"change":"published","superseded_by":[],"changed":{"id":4640,"cve_ids":["CVE-2026-100693"],"payload":{"kind":"advisory","title":"Hugo v0.162.0 before v0.166.0 IP-literal Deny Rule Bypass","summary":"Hugo versions from v0.162.0 before v0.166.0 contain a case-sensitive validation flaw in the security.http.urls IP-literal deny rule that allows attackers to bypass restrictions. Attackers can use mixed-case URL schemes in resources.GetRemote calls to fetch from restricted IP addresses like localhost.","evidence":"cve:CVE-2026-100693","products":[{"name":{"value":"hugo","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-100693","aliases":["CVE-2026-100693"],"metrics":[{"format":"CVSS","cvssV4_0":{"Safety":"NOT_DEFINED","version":"4.0","Recovery":"NOT_DEFINED","baseScore":8.6,"Automatable":"NOT_DEFINED","attackVector":"LOCAL","baseSeverity":"HIGH","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","exploitMaturity":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":8.4,"attackVector":"LOCAL","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"gohugoio","product":"hugo","versions":[{"status":"affected","version":"0.162.0","lessThan":"0.166.0","versionType":"semver"},{"status":"unaffected","version":"0.166.0","versionType":"semver"}],"packageURL":"pkg:golang/github.com/gohugoio/hugo","defaultStatus":"unaffected"}],"modified":"2026-09-30T17:05:28.149Z","provider":"cve","references":["https://github.com/gohugoio/hugo/security/advisories/GHSA-pmrv-x7gp-2rjw","https://www.vulncheck.com/advisories/hugo-0.162.0-before-0.166.0-ip-literal-deny-rule-bypass"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-100693","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-09-30T17:05:19.378001Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-30T17:05:28.149Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-09-26T13:23:51.556Z"}}},"related_cves":[{"value":"CVE-2026-100693","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:7917208a-1693-41c5-9a4e-92677ac27ae3","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-100693","advisory_id":"7917208a-1693-41c5-9a4e-92677ac27ae3","event_types":["advisory"],"published_at":"2026-10-24T21:55:36.76161+00:00","technologies":["core-cve","hugo"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-26T13:23:51.556+00:00","detail_url":"/events/4640"},"members":[{"id":4640,"cve_ids":["CVE-2026-100693"],"payload":{"kind":"advisory","title":"Hugo v0.162.0 before v0.166.0 IP-literal Deny Rule Bypass","summary":"Hugo versions from v0.162.0 before v0.166.0 contain a case-sensitive validation flaw in the security.http.urls IP-literal deny rule that allows attackers to bypass restrictions. Attackers can use mixed-case URL schemes in resources.GetRemote calls to fetch from restricted IP addresses like localhost.","evidence":"cve:CVE-2026-100693","products":[{"name":{"value":"hugo","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-100693","aliases":["CVE-2026-100693"],"metrics":[{"format":"CVSS","cvssV4_0":{"Safety":"NOT_DEFINED","version":"4.0","Recovery":"NOT_DEFINED","baseScore":8.6,"Automatable":"NOT_DEFINED","attackVector":"LOCAL","baseSeverity":"HIGH","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","exploitMaturity":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":8.4,"attackVector":"LOCAL","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"gohugoio","product":"hugo","versions":[{"status":"affected","version":"0.162.0","lessThan":"0.166.0","versionType":"semver"},{"status":"unaffected","version":"0.166.0","versionType":"semver"}],"packageURL":"pkg:golang/github.com/gohugoio/hugo","defaultStatus":"unaffected"}],"modified":"2026-09-30T17:05:28.149Z","provider":"cve","references":["https://github.com/gohugoio/hugo/security/advisories/GHSA-pmrv-x7gp-2rjw","https://www.vulncheck.com/advisories/hugo-0.162.0-before-0.166.0-ip-literal-deny-rule-bypass"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-100693","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-09-30T17:05:19.378001Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-30T17:05:28.149Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-09-26T13:23:51.556Z"}}},"related_cves":[{"value":"CVE-2026-100693","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:7917208a-1693-41c5-9a4e-92677ac27ae3","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-100693","advisory_id":"7917208a-1693-41c5-9a4e-92677ac27ae3","event_types":["advisory"],"published_at":"2026-10-24T21:55:36.76161+00:00","technologies":["core-cve","hugo"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-26T13:23:51.556+00:00","detail_url":"/events/4640"}]}},{"id":4427,"cve_ids":["CVE-2026-100694"],"payload":{"kind":"advisory","title":"Hugo before 0.166.0 Cross-Site Scripting via text/org","summary":"Hugo is a static site generator. In versions from v0.56.0 through v0.165.x, content files mapped to the text/org media type are rendered without escaping raw HTML: Org export blocks and @@html:...@@ snippets pass HTML through unescaped, resulting in cross-site scripting (XSS) in the generated site. An attacker who can supply or influence a content file under /content or the output of a content adapter can inject scripts that execute in the browsers of visitors to the affected pages. Only pages whose source file or content-adapter output declares the text/org media type are affected, and sites that fully trust all content sources are not impacted. Version v0.166.0 fixes the issue by introducing a security.allowContent allowlist that denies text/org by default; sites that intentionally author Org Mode content can opt back in with [security] allowContent = ['.*'].","evidence":"cve:CVE-2026-100694","products":[{"name":{"value":"hugo","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-100694","aliases":["CVE-2026-100694"],"metrics":[{"format":"CVSS","cvssV4_0":{"Safety":"NOT_DEFINED","version":"4.0","Recovery":"NOT_DEFINED","baseScore":5.1,"Automatable":"NOT_DEFINED","attackVector":"NETWORK","baseSeverity":"MEDIUM","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","exploitMaturity":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","userInteraction":"ACTIVE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"LOW","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","vulnConfidentialityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"}},{"format":"CVSS","cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":6.1,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","integrityImpact":"LOW","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"LOW"}}],"affected":[{"vendor":"gohugoio","product":"hugo","versions":[{"status":"affected","version":"0.56.0","lessThan":"0.166.0","versionType":"semver"},{"status":"unaffected","version":"0.166.0","versionType":"semver"}],"packageURL":"pkg:golang/github.com/gohugoio/hugo","defaultStatus":"unaffected"}],"modified":"2026-09-30T15:05:16.280Z","provider":"cve","references":["https://github.com/gohugoio/hugo/security/advisories/GHSA-pq74-mj4h-cjq2","https://www.vulncheck.com/advisories/hugo-before-0.166.0-cross-site-scripting-via-text-org"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-100694","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-30T15:05:06.488369Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-30T15:05:16.280Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-09-26T13:23:52.256Z"}}},"related_cves":[{"value":"CVE-2026-100694","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:5c9b22aa-8262-47c8-b5bd-a388457120c0","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-100694","advisory_id":"5c9b22aa-8262-47c8-b5bd-a388457120c0","event_types":["advisory"],"published_at":"2026-10-24T21:52:25.23022+00:00","technologies":["core-cve","hugo"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-26T13:23:52.256+00:00","detail_url":"/advisories/advisory%3A5c9b22aa-8262-47c8-b5bd-a388457120c0","group":{"id":"advisory:5c9b22aa-8262-47c8-b5bd-a388457120c0","revision":1,"primary_event_id":4445,"change":"published","superseded_by":[],"changed":{"id":4445,"cve_ids":["CVE-2026-100694"],"payload":{"kind":"advisory","title":"Hugo before 0.166.0 Cross-Site Scripting via text/org","summary":"Hugo is a static site generator. In versions from v0.56.0 through v0.165.x, content files mapped to the text/org media type are rendered without escaping raw HTML: Org export blocks and @@html:...@@ snippets pass HTML through unescaped, resulting in cross-site scripting (XSS) in the generated site. An attacker who can supply or influence a content file under /content or the output of a content adapter can inject scripts that execute in the browsers of visitors to the affected pages. Only pages whose source file or content-adapter output declares the text/org media type are affected, and sites that fully trust all content sources are not impacted. Version v0.166.0 fixes the issue by introducing a security.allowContent allowlist that denies text/org by default; sites that intentionally author Org Mode content can opt back in with [security] allowContent = ['.*'].","evidence":"cve:CVE-2026-100694","products":[{"name":{"value":"hugo","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-100694","aliases":["CVE-2026-100694"],"metrics":[{"format":"CVSS","cvssV4_0":{"Safety":"NOT_DEFINED","version":"4.0","Recovery":"NOT_DEFINED","baseScore":5.1,"Automatable":"NOT_DEFINED","attackVector":"NETWORK","baseSeverity":"MEDIUM","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","exploitMaturity":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","userInteraction":"ACTIVE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"LOW","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","vulnConfidentialityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"}},{"format":"CVSS","cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":6.1,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","integrityImpact":"LOW","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"LOW"}}],"affected":[{"vendor":"gohugoio","product":"hugo","versions":[{"status":"affected","version":"0.56.0","lessThan":"0.166.0","versionType":"semver"},{"status":"unaffected","version":"0.166.0","versionType":"semver"}],"packageURL":"pkg:golang/github.com/gohugoio/hugo","defaultStatus":"unaffected"}],"modified":"2026-09-30T15:05:16.280Z","provider":"cve","references":["https://github.com/gohugoio/hugo/security/advisories/GHSA-pq74-mj4h-cjq2","https://www.vulncheck.com/advisories/hugo-before-0.166.0-cross-site-scripting-via-text-org"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-100694","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-30T15:05:06.488369Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-30T15:05:16.280Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-09-26T13:23:52.256Z"}}},"related_cves":[{"value":"CVE-2026-100694","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:5c9b22aa-8262-47c8-b5bd-a388457120c0","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-100694","advisory_id":"5c9b22aa-8262-47c8-b5bd-a388457120c0","event_types":["advisory"],"published_at":"2026-10-24T21:52:25.23022+00:00","technologies":["core-cve","hugo"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-26T13:23:52.256+00:00","detail_url":"/events/4445"},"members":[{"id":4445,"cve_ids":["CVE-2026-100694"],"payload":{"kind":"advisory","title":"Hugo before 0.166.0 Cross-Site Scripting via text/org","summary":"Hugo is a static site generator. In versions from v0.56.0 through v0.165.x, content files mapped to the text/org media type are rendered without escaping raw HTML: Org export blocks and @@html:...@@ snippets pass HTML through unescaped, resulting in cross-site scripting (XSS) in the generated site. An attacker who can supply or influence a content file under /content or the output of a content adapter can inject scripts that execute in the browsers of visitors to the affected pages. Only pages whose source file or content-adapter output declares the text/org media type are affected, and sites that fully trust all content sources are not impacted. Version v0.166.0 fixes the issue by introducing a security.allowContent allowlist that denies text/org by default; sites that intentionally author Org Mode content can opt back in with [security] allowContent = ['.*'].","evidence":"cve:CVE-2026-100694","products":[{"name":{"value":"hugo","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-100694","aliases":["CVE-2026-100694"],"metrics":[{"format":"CVSS","cvssV4_0":{"Safety":"NOT_DEFINED","version":"4.0","Recovery":"NOT_DEFINED","baseScore":5.1,"Automatable":"NOT_DEFINED","attackVector":"NETWORK","baseSeverity":"MEDIUM","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","exploitMaturity":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","userInteraction":"ACTIVE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"LOW","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","vulnConfidentialityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"}},{"format":"CVSS","cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":6.1,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","integrityImpact":"LOW","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"LOW"}}],"affected":[{"vendor":"gohugoio","product":"hugo","versions":[{"status":"affected","version":"0.56.0","lessThan":"0.166.0","versionType":"semver"},{"status":"unaffected","version":"0.166.0","versionType":"semver"}],"packageURL":"pkg:golang/github.com/gohugoio/hugo","defaultStatus":"unaffected"}],"modified":"2026-09-30T15:05:16.280Z","provider":"cve","references":["https://github.com/gohugoio/hugo/security/advisories/GHSA-pq74-mj4h-cjq2","https://www.vulncheck.com/advisories/hugo-before-0.166.0-cross-site-scripting-via-text-org"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-100694","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-30T15:05:06.488369Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-30T15:05:16.280Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-09-26T13:23:52.256Z"}}},"related_cves":[{"value":"CVE-2026-100694","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:5c9b22aa-8262-47c8-b5bd-a388457120c0","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-100694","advisory_id":"5c9b22aa-8262-47c8-b5bd-a388457120c0","event_types":["advisory"],"published_at":"2026-10-24T21:52:25.23022+00:00","technologies":["core-cve","hugo"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-26T13:23:52.256+00:00","detail_url":"/events/4445"}]}},{"id":4426,"cve_ids":["CVE-2026-100690"],"payload":{"kind":"advisory","title":"Hugo v0.161.0 to v0.165.0 Arbitrary File Read via Symlinks","summary":"Hugo versions from v0.161.0 through v0.165.0 run Node.js tools (css.PostCSS, css.TailwindCSS, js.Babel) under the Node.js permission model to restrict file system reads to the project directory and configured mounts. Because the Node.js permission model validates only the lexical path and follows symbolic links that point outside the allowed set, Hugo did not detect symlinks escaping the sandbox. An attacker who can contribute content to a Hugo project (for example via a pull request) can commit a symlink such as assets/css/x.css -> /etc/passwd together with a PostCSS plugin that reads it, allowing any file readable by the Hugo build process to be disclosed and potentially embedded in the published site. This affects builds using the default security configuration; projects that do not invoke Node.js tools are unaffected. Fixed in v0.166.0, which scans allowed paths and fails the build when a symbolic link resolves outside them.","evidence":"cve:CVE-2026-100690","products":[{"name":{"value":"hugo","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-100690","aliases":["CVE-2026-100690"],"metrics":[{"format":"CVSS","cvssV4_0":{"Safety":"NOT_DEFINED","version":"4.0","Recovery":"NOT_DEFINED","baseScore":8.7,"Automatable":"NOT_DEFINED","attackVector":"NETWORK","baseSeverity":"HIGH","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","exploitMaturity":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"gohugoio","product":"hugo","versions":[{"status":"affected","version":"0.161.0","lessThan":"0.166.0","versionType":"semver"},{"status":"unaffected","version":"0.166.0","versionType":"semver"}],"packageURL":"pkg:golang/github.com/gohugoio/hugo","defaultStatus":"unaffected"}],"modified":"2026-09-30T15:04:40.978Z","provider":"cve","references":["https://github.com/gohugoio/hugo/security/advisories/GHSA-x3mx-cm49-8m9c","https://www.vulncheck.com/advisories/hugo-0.161.0-to-0.165.0-arbitrary-file-read-via-symlinks"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-100690","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-30T15:04:21.434495Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-30T15:04:40.978Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-09-26T13:23:49.448Z"}}},"related_cves":[{"value":"CVE-2026-100690","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:392cf575-eca7-4df7-8b2e-a0b328795138","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-100690","advisory_id":"392cf575-eca7-4df7-8b2e-a0b328795138","event_types":["advisory"],"published_at":"2026-10-24T21:52:24.236236+00:00","technologies":["core-cve","hugo"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-26T13:23:49.448+00:00","detail_url":"/advisories/advisory%3A392cf575-eca7-4df7-8b2e-a0b328795138","group":{"id":"advisory:392cf575-eca7-4df7-8b2e-a0b328795138","revision":1,"primary_event_id":4444,"change":"published","superseded_by":[],"changed":{"id":4444,"cve_ids":["CVE-2026-100690"],"payload":{"kind":"advisory","title":"Hugo v0.161.0 to v0.165.0 Arbitrary File Read via Symlinks","summary":"Hugo versions from v0.161.0 through v0.165.0 run Node.js tools (css.PostCSS, css.TailwindCSS, js.Babel) under the Node.js permission model to restrict file system reads to the project directory and configured mounts. Because the Node.js permission model validates only the lexical path and follows symbolic links that point outside the allowed set, Hugo did not detect symlinks escaping the sandbox. An attacker who can contribute content to a Hugo project (for example via a pull request) can commit a symlink such as assets/css/x.css -> /etc/passwd together with a PostCSS plugin that reads it, allowing any file readable by the Hugo build process to be disclosed and potentially embedded in the published site. This affects builds using the default security configuration; projects that do not invoke Node.js tools are unaffected. Fixed in v0.166.0, which scans allowed paths and fails the build when a symbolic link resolves outside them.","evidence":"cve:CVE-2026-100690","products":[{"name":{"value":"hugo","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-100690","aliases":["CVE-2026-100690"],"metrics":[{"format":"CVSS","cvssV4_0":{"Safety":"NOT_DEFINED","version":"4.0","Recovery":"NOT_DEFINED","baseScore":8.7,"Automatable":"NOT_DEFINED","attackVector":"NETWORK","baseSeverity":"HIGH","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","exploitMaturity":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"gohugoio","product":"hugo","versions":[{"status":"affected","version":"0.161.0","lessThan":"0.166.0","versionType":"semver"},{"status":"unaffected","version":"0.166.0","versionType":"semver"}],"packageURL":"pkg:golang/github.com/gohugoio/hugo","defaultStatus":"unaffected"}],"modified":"2026-09-30T15:04:40.978Z","provider":"cve","references":["https://github.com/gohugoio/hugo/security/advisories/GHSA-x3mx-cm49-8m9c","https://www.vulncheck.com/advisories/hugo-0.161.0-to-0.165.0-arbitrary-file-read-via-symlinks"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-100690","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-30T15:04:21.434495Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-30T15:04:40.978Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-09-26T13:23:49.448Z"}}},"related_cves":[{"value":"CVE-2026-100690","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:392cf575-eca7-4df7-8b2e-a0b328795138","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-100690","advisory_id":"392cf575-eca7-4df7-8b2e-a0b328795138","event_types":["advisory"],"published_at":"2026-10-24T21:52:24.236236+00:00","technologies":["core-cve","hugo"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-26T13:23:49.448+00:00","detail_url":"/events/4444"},"members":[{"id":4444,"cve_ids":["CVE-2026-100690"],"payload":{"kind":"advisory","title":"Hugo v0.161.0 to v0.165.0 Arbitrary File Read via Symlinks","summary":"Hugo versions from v0.161.0 through v0.165.0 run Node.js tools (css.PostCSS, css.TailwindCSS, js.Babel) under the Node.js permission model to restrict file system reads to the project directory and configured mounts. Because the Node.js permission model validates only the lexical path and follows symbolic links that point outside the allowed set, Hugo did not detect symlinks escaping the sandbox. An attacker who can contribute content to a Hugo project (for example via a pull request) can commit a symlink such as assets/css/x.css -> /etc/passwd together with a PostCSS plugin that reads it, allowing any file readable by the Hugo build process to be disclosed and potentially embedded in the published site. This affects builds using the default security configuration; projects that do not invoke Node.js tools are unaffected. Fixed in v0.166.0, which scans allowed paths and fails the build when a symbolic link resolves outside them.","evidence":"cve:CVE-2026-100690","products":[{"name":{"value":"hugo","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-100690","aliases":["CVE-2026-100690"],"metrics":[{"format":"CVSS","cvssV4_0":{"Safety":"NOT_DEFINED","version":"4.0","Recovery":"NOT_DEFINED","baseScore":8.7,"Automatable":"NOT_DEFINED","attackVector":"NETWORK","baseSeverity":"HIGH","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","exploitMaturity":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"gohugoio","product":"hugo","versions":[{"status":"affected","version":"0.161.0","lessThan":"0.166.0","versionType":"semver"},{"status":"unaffected","version":"0.166.0","versionType":"semver"}],"packageURL":"pkg:golang/github.com/gohugoio/hugo","defaultStatus":"unaffected"}],"modified":"2026-09-30T15:04:40.978Z","provider":"cve","references":["https://github.com/gohugoio/hugo/security/advisories/GHSA-x3mx-cm49-8m9c","https://www.vulncheck.com/advisories/hugo-0.161.0-to-0.165.0-arbitrary-file-read-via-symlinks"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-100690","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-30T15:04:21.434495Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-30T15:04:40.978Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-09-26T13:23:49.448Z"}}},"related_cves":[{"value":"CVE-2026-100690","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:392cf575-eca7-4df7-8b2e-a0b328795138","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-100690","advisory_id":"392cf575-eca7-4df7-8b2e-a0b328795138","event_types":["advisory"],"published_at":"2026-10-24T21:52:24.236236+00:00","technologies":["core-cve","hugo"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-26T13:23:49.448+00:00","detail_url":"/events/4444"}]}},{"id":3263,"cve_ids":["CVE-2026-100691"],"payload":{"kind":"advisory","title":"Hugo before 0.166.0 Stored XSS via lineAnchors code block option","summary":"Hugo versions 0.75.0 through 0.165.x contain a stored cross-site scripting vulnerability: the syntax highlighter does not escape the `lineAnchors` option before passing it to Chroma, which writes the value verbatim into the `id` and `href` attributes of the generated line-number markup. A crafted `lineAnchors` value supplied as a Markdown code fence attribute (or passed to the `highlight` template function) results in unescaped HTML in the rendered page, allowing arbitrary JavaScript to execute in the browsers of visitors to the generated site. This affects sites that build and publish Markdown from untrusted contributors; Hugo's security model otherwise considers content trusted input. Fixed in 0.166.0, where the `lineAnchors` value is HTML-escaped before being passed to Chroma.","evidence":"cve:CVE-2026-100691","products":[{"name":{"value":"hugo","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-100691","aliases":["CVE-2026-100691"],"metrics":[{"format":"CVSS","cvssV4_0":{"Safety":"NOT_DEFINED","version":"4.0","Recovery":"NOT_DEFINED","baseScore":5.1,"Automatable":"NOT_DEFINED","attackVector":"NETWORK","baseSeverity":"MEDIUM","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","exploitMaturity":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","userInteraction":"PASSIVE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"LOW","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","vulnConfidentialityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"}},{"format":"CVSS","cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":5.4,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","integrityImpact":"LOW","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"LOW"}}],"affected":[{"vendor":"gohugoio","product":"hugo","versions":[{"status":"affected","version":"0.75.0","lessThan":"0.166.0","versionType":"semver"},{"status":"unaffected","version":"0.166.0","versionType":"semver"}],"packageURL":"pkg:golang/github.com/gohugoio/hugo","defaultStatus":"unaffected"}],"modified":"2026-09-28T17:51:34.652Z","provider":"cve","references":["https://github.com/gohugoio/hugo/security/advisories/GHSA-q4xf-287f-98r8","https://www.vulncheck.com/advisories/hugo-before-0.166.0-stored-xss-via-lineanchors-code-block-option"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-100691","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-28T17:51:21.843171Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-28T17:51:34.652Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-09-26T13:23:50.149Z"}}},"related_cves":[{"value":"CVE-2026-100691","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:7024c819-dece-4563-bdae-a6cef4e4af06","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-100691","advisory_id":"7024c819-dece-4563-bdae-a6cef4e4af06","event_types":["advisory"],"published_at":"2026-10-24T21:32:03.267206+00:00","technologies":["core-cve","hugo"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-26T13:23:50.149+00:00","detail_url":"/advisories/advisory%3A7024c819-dece-4563-bdae-a6cef4e4af06","group":{"id":"advisory:7024c819-dece-4563-bdae-a6cef4e4af06","revision":1,"primary_event_id":3275,"change":"published","superseded_by":[],"changed":{"id":3275,"cve_ids":["CVE-2026-100691"],"payload":{"kind":"advisory","title":"Hugo before 0.166.0 Stored XSS via lineAnchors code block option","summary":"Hugo versions 0.75.0 through 0.165.x contain a stored cross-site scripting vulnerability: the syntax highlighter does not escape the `lineAnchors` option before passing it to Chroma, which writes the value verbatim into the `id` and `href` attributes of the generated line-number markup. A crafted `lineAnchors` value supplied as a Markdown code fence attribute (or passed to the `highlight` template function) results in unescaped HTML in the rendered page, allowing arbitrary JavaScript to execute in the browsers of visitors to the generated site. This affects sites that build and publish Markdown from untrusted contributors; Hugo's security model otherwise considers content trusted input. Fixed in 0.166.0, where the `lineAnchors` value is HTML-escaped before being passed to Chroma.","evidence":"cve:CVE-2026-100691","products":[{"name":{"value":"hugo","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-100691","aliases":["CVE-2026-100691"],"metrics":[{"format":"CVSS","cvssV4_0":{"Safety":"NOT_DEFINED","version":"4.0","Recovery":"NOT_DEFINED","baseScore":5.1,"Automatable":"NOT_DEFINED","attackVector":"NETWORK","baseSeverity":"MEDIUM","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","exploitMaturity":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","userInteraction":"PASSIVE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"LOW","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","vulnConfidentialityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"}},{"format":"CVSS","cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":5.4,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","integrityImpact":"LOW","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"LOW"}}],"affected":[{"vendor":"gohugoio","product":"hugo","versions":[{"status":"affected","version":"0.75.0","lessThan":"0.166.0","versionType":"semver"},{"status":"unaffected","version":"0.166.0","versionType":"semver"}],"packageURL":"pkg:golang/github.com/gohugoio/hugo","defaultStatus":"unaffected"}],"modified":"2026-09-28T17:51:34.652Z","provider":"cve","references":["https://github.com/gohugoio/hugo/security/advisories/GHSA-q4xf-287f-98r8","https://www.vulncheck.com/advisories/hugo-before-0.166.0-stored-xss-via-lineanchors-code-block-option"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-100691","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-28T17:51:21.843171Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-28T17:51:34.652Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-09-26T13:23:50.149Z"}}},"related_cves":[{"value":"CVE-2026-100691","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:7024c819-dece-4563-bdae-a6cef4e4af06","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-100691","advisory_id":"7024c819-dece-4563-bdae-a6cef4e4af06","event_types":["advisory"],"published_at":"2026-10-24T21:32:03.267206+00:00","technologies":["core-cve","hugo"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-26T13:23:50.149+00:00","detail_url":"/events/3275"},"members":[{"id":3275,"cve_ids":["CVE-2026-100691"],"payload":{"kind":"advisory","title":"Hugo before 0.166.0 Stored XSS via lineAnchors code block option","summary":"Hugo versions 0.75.0 through 0.165.x contain a stored cross-site scripting vulnerability: the syntax highlighter does not escape the `lineAnchors` option before passing it to Chroma, which writes the value verbatim into the `id` and `href` attributes of the generated line-number markup. A crafted `lineAnchors` value supplied as a Markdown code fence attribute (or passed to the `highlight` template function) results in unescaped HTML in the rendered page, allowing arbitrary JavaScript to execute in the browsers of visitors to the generated site. This affects sites that build and publish Markdown from untrusted contributors; Hugo's security model otherwise considers content trusted input. Fixed in 0.166.0, where the `lineAnchors` value is HTML-escaped before being passed to Chroma.","evidence":"cve:CVE-2026-100691","products":[{"name":{"value":"hugo","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-100691","aliases":["CVE-2026-100691"],"metrics":[{"format":"CVSS","cvssV4_0":{"Safety":"NOT_DEFINED","version":"4.0","Recovery":"NOT_DEFINED","baseScore":5.1,"Automatable":"NOT_DEFINED","attackVector":"NETWORK","baseSeverity":"MEDIUM","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","exploitMaturity":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","userInteraction":"PASSIVE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"LOW","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","vulnConfidentialityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"}},{"format":"CVSS","cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":5.4,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","integrityImpact":"LOW","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"LOW"}}],"affected":[{"vendor":"gohugoio","product":"hugo","versions":[{"status":"affected","version":"0.75.0","lessThan":"0.166.0","versionType":"semver"},{"status":"unaffected","version":"0.166.0","versionType":"semver"}],"packageURL":"pkg:golang/github.com/gohugoio/hugo","defaultStatus":"unaffected"}],"modified":"2026-09-28T17:51:34.652Z","provider":"cve","references":["https://github.com/gohugoio/hugo/security/advisories/GHSA-q4xf-287f-98r8","https://www.vulncheck.com/advisories/hugo-before-0.166.0-stored-xss-via-lineanchors-code-block-option"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-100691","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-28T17:51:21.843171Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-28T17:51:34.652Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-09-26T13:23:50.149Z"}}},"related_cves":[{"value":"CVE-2026-100691","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:7024c819-dece-4563-bdae-a6cef4e4af06","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-100691","advisory_id":"7024c819-dece-4563-bdae-a6cef4e4af06","event_types":["advisory"],"published_at":"2026-10-24T21:32:03.267206+00:00","technologies":["core-cve","hugo"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-26T13:23:50.149+00:00","detail_url":"/events/3275"}]}},{"id":3186,"cve_ids":["CVE-2026-100692"],"payload":{"kind":"advisory","title":"Hugo before v0.166.0 Path Traversal via Symlinked Mount Roots","summary":"Hugo is a static site generator. In versions after v0.123.0 and before v0.166.0, Hugo's symlink confinement checks stopped at the mount root itself, so a theme or module checked into themes/ (or a vendored module) could contain a symlink at a mount root (for example themes/mytheme/assets -> /some/dir/outside). Files behind such a symlink were readable during a site build through resources.Get, resources.Match and similar functions, and could be published to public/ via static mounts, bypassing the rule that theme and module mount sources must be local paths. Modules fetched via Go modules are not affected because Go module zips cannot contain symlinks, and this is not an escalation for the main project, which may already mount absolute paths by configuration. Fixed in v0.166.0, where symlinked mount roots and symlinked directories between the mount root and the module directory are treated as non-existent for all modules. As a workaround, inspect themes/ and vendored modules for symlinks at mount roots before building, or replace symlinks with explicit mounts.","evidence":"cve:CVE-2026-100692","products":[{"name":{"value":"hugo","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-100692","aliases":["CVE-2026-100692"],"metrics":[{"format":"CVSS","cvssV4_0":{"Safety":"NOT_DEFINED","version":"4.0","Recovery":"NOT_DEFINED","baseScore":8.7,"Automatable":"NOT_DEFINED","attackVector":"NETWORK","baseSeverity":"HIGH","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","exploitMaturity":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"gohugoio","product":"hugo","versions":[{"status":"affected","version":"0","lessThan":"0.166.0","versionType":"semver"},{"status":"unaffected","version":"0.166.0","versionType":"semver"}],"packageURL":"pkg:golang/github.com/gohugoio/hugo","defaultStatus":"unaffected"}],"modified":"2026-09-28T16:30:24.018Z","provider":"cve","references":["https://github.com/gohugoio/hugo/security/advisories/GHSA-797m-7j5g-3rpr","https://www.vulncheck.com/advisories/hugo-before-0.166.0-path-traversal-via-symlinked-mount-roots"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-100692","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-28T16:30:07.157360Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-28T16:30:24.018Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-09-26T13:23:50.847Z"}}},"related_cves":[{"value":"CVE-2026-100692","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:103c65a9-d207-4a96-b4a9-2b0aa0790276","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-100692","advisory_id":"103c65a9-d207-4a96-b4a9-2b0aa0790276","event_types":["advisory"],"published_at":"2026-10-24T21:31:15.315137+00:00","technologies":["core-cve","hugo"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-26T13:23:50.847+00:00","detail_url":"/advisories/advisory%3A103c65a9-d207-4a96-b4a9-2b0aa0790276","group":{"id":"advisory:103c65a9-d207-4a96-b4a9-2b0aa0790276","revision":1,"primary_event_id":3197,"change":"published","superseded_by":[],"changed":{"id":3197,"cve_ids":["CVE-2026-100692"],"payload":{"kind":"advisory","title":"Hugo before v0.166.0 Path Traversal via Symlinked Mount Roots","summary":"Hugo is a static site generator. In versions after v0.123.0 and before v0.166.0, Hugo's symlink confinement checks stopped at the mount root itself, so a theme or module checked into themes/ (or a vendored module) could contain a symlink at a mount root (for example themes/mytheme/assets -> /some/dir/outside). Files behind such a symlink were readable during a site build through resources.Get, resources.Match and similar functions, and could be published to public/ via static mounts, bypassing the rule that theme and module mount sources must be local paths. Modules fetched via Go modules are not affected because Go module zips cannot contain symlinks, and this is not an escalation for the main project, which may already mount absolute paths by configuration. Fixed in v0.166.0, where symlinked mount roots and symlinked directories between the mount root and the module directory are treated as non-existent for all modules. As a workaround, inspect themes/ and vendored modules for symlinks at mount roots before building, or replace symlinks with explicit mounts.","evidence":"cve:CVE-2026-100692","products":[{"name":{"value":"hugo","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-100692","aliases":["CVE-2026-100692"],"metrics":[{"format":"CVSS","cvssV4_0":{"Safety":"NOT_DEFINED","version":"4.0","Recovery":"NOT_DEFINED","baseScore":8.7,"Automatable":"NOT_DEFINED","attackVector":"NETWORK","baseSeverity":"HIGH","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","exploitMaturity":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"gohugoio","product":"hugo","versions":[{"status":"affected","version":"0","lessThan":"0.166.0","versionType":"semver"},{"status":"unaffected","version":"0.166.0","versionType":"semver"}],"packageURL":"pkg:golang/github.com/gohugoio/hugo","defaultStatus":"unaffected"}],"modified":"2026-09-28T16:30:24.018Z","provider":"cve","references":["https://github.com/gohugoio/hugo/security/advisories/GHSA-797m-7j5g-3rpr","https://www.vulncheck.com/advisories/hugo-before-0.166.0-path-traversal-via-symlinked-mount-roots"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-100692","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-28T16:30:07.157360Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-28T16:30:24.018Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-09-26T13:23:50.847Z"}}},"related_cves":[{"value":"CVE-2026-100692","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:103c65a9-d207-4a96-b4a9-2b0aa0790276","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-100692","advisory_id":"103c65a9-d207-4a96-b4a9-2b0aa0790276","event_types":["advisory"],"published_at":"2026-10-24T21:31:15.315137+00:00","technologies":["core-cve","hugo"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-26T13:23:50.847+00:00","detail_url":"/events/3197"},"members":[{"id":3197,"cve_ids":["CVE-2026-100692"],"payload":{"kind":"advisory","title":"Hugo before v0.166.0 Path Traversal via Symlinked Mount Roots","summary":"Hugo is a static site generator. In versions after v0.123.0 and before v0.166.0, Hugo's symlink confinement checks stopped at the mount root itself, so a theme or module checked into themes/ (or a vendored module) could contain a symlink at a mount root (for example themes/mytheme/assets -> /some/dir/outside). Files behind such a symlink were readable during a site build through resources.Get, resources.Match and similar functions, and could be published to public/ via static mounts, bypassing the rule that theme and module mount sources must be local paths. Modules fetched via Go modules are not affected because Go module zips cannot contain symlinks, and this is not an escalation for the main project, which may already mount absolute paths by configuration. Fixed in v0.166.0, where symlinked mount roots and symlinked directories between the mount root and the module directory are treated as non-existent for all modules. As a workaround, inspect themes/ and vendored modules for symlinks at mount roots before building, or replace symlinks with explicit mounts.","evidence":"cve:CVE-2026-100692","products":[{"name":{"value":"hugo","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-100692","aliases":["CVE-2026-100692"],"metrics":[{"format":"CVSS","cvssV4_0":{"Safety":"NOT_DEFINED","version":"4.0","Recovery":"NOT_DEFINED","baseScore":8.7,"Automatable":"NOT_DEFINED","attackVector":"NETWORK","baseSeverity":"HIGH","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","exploitMaturity":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"gohugoio","product":"hugo","versions":[{"status":"affected","version":"0","lessThan":"0.166.0","versionType":"semver"},{"status":"unaffected","version":"0.166.0","versionType":"semver"}],"packageURL":"pkg:golang/github.com/gohugoio/hugo","defaultStatus":"unaffected"}],"modified":"2026-09-28T16:30:24.018Z","provider":"cve","references":["https://github.com/gohugoio/hugo/security/advisories/GHSA-797m-7j5g-3rpr","https://www.vulncheck.com/advisories/hugo-before-0.166.0-path-traversal-via-symlinked-mount-roots"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-100692","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-28T16:30:07.157360Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-28T16:30:24.018Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-09-26T13:23:50.847Z"}}},"related_cves":[{"value":"CVE-2026-100692","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:103c65a9-d207-4a96-b4a9-2b0aa0790276","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-100692","advisory_id":"103c65a9-d207-4a96-b4a9-2b0aa0790276","event_types":["advisory"],"published_at":"2026-10-24T21:31:15.315137+00:00","technologies":["core-cve","hugo"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-26T13:23:50.847+00:00","detail_url":"/events/3197"}]}},{"id":991,"cve_ids":["CVE-2026-75926"],"payload":{"kind":"advisory","title":"Hugo 0.162.0 to 0.164.x - Node Permission Model Bypass via Default TailwindCSS Child-Process Grant","summary":"Hugo 0.161.0 placed the Node asset pipelines behind the Node.js permission model so that code running through PostCSS, Babel, or TailwindCSS could not reach the file system outside the project directory. Hugo 0.162.0 added tailwindcss to the AllowChildProcess default in config/security/securityConfig.go, which makes nodePermissionArgs in common/hexec/exec.go append --allow-child-process whenever the tool being launched is named tailwindcss. TailwindCSS loads the site's tailwind.config.js through require at startup, so top-level code in that file executes inside the permitted Node process and can call child_process to spawn a shell. The spawned process is not a Node process and inherits none of the permission flags, so it runs with the full privileges of the account performing the build. Building a site whose theme, module, or starter template supplies the Tailwind configuration therefore yields arbitrary command execution rather than the confined file access the permission model was introduced to enforce. Hugo 0.165.0 removes tailwindcss from the default security.exec.allow list, so the tool is no longer launched under the default configuration.","evidence":"cve:CVE-2026-75926","products":[{"name":{"value":"hugo","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","structured":{"id":"CVE-2026-75926","aliases":["CVE-2026-75926"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":9.3,"attackVector":"LOCAL","baseSeverity":"CRITICAL","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","userInteraction":"PASSIVE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"HIGH","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","vulnConfidentialityImpact":"HIGH"}},{"format":"CVSS","cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":8.6,"attackVector":"LOCAL","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}}],"affected":[{"repo":"https://github.com/gohugoio/hugo","vendor":"gohugoio","product":"hugo","versions":[{"status":"affected","version":"0.162.0","lessThan":"0.165.0","versionType":"semver"}],"packageURL":"pkg:golang/github.com/gohugoio/hugo","defaultStatus":"unaffected"}],"modified":"2026-09-24T14:19:33.478Z","provider":"cve","references":["https://github.com/gohugoio/hugo/commit/8a55df7af2e6da31297245cc54fa2e3b521d93e8","https://github.com/gohugoio/hugo/issues/15178","https://github.com/gohugoio/hugo/blob/v0.164.0/config/security/securityConfig.go#L72-L79","https://github.com/gohugoio/hugo/blob/v0.164.0/common/hexec/exec.go#L292-L295","https://github.com/gohugoio/hugo","https://www.vulncheck.com/advisories/hugo-to-x-node-permission-model-bypass-via-default-tailwindcss-child-process-grant"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-75926","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-08-19T00:00:00+00:00"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-08-20T03:55:58.115Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-09-24T14:19:33.478Z"}}},"related_cves":[{"value":"CVE-2026-75926","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:b256044d-7a76-4cb7-9c81-8dd27f8af883","priority":{"reasons":["publisher_severity"],"severity":"critical","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"critical"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-75926","advisory_id":"b256044d-7a76-4cb7-9c81-8dd27f8af883","event_types":["advisory"],"published_at":"2026-10-24T20:54:34.650179+00:00","technologies":["core-cve","hugo"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-08-18T15:47:49.048+00:00","detail_url":"/advisories/advisory%3Ab256044d-7a76-4cb7-9c81-8dd27f8af883","group":{"id":"advisory:b256044d-7a76-4cb7-9c81-8dd27f8af883","revision":1,"primary_event_id":985,"change":"published","superseded_by":[],"changed":{"id":985,"cve_ids":["CVE-2026-75926"],"payload":{"kind":"advisory","title":"Hugo 0.162.0 to 0.164.x - Node Permission Model Bypass via Default TailwindCSS Child-Process Grant","summary":"Hugo 0.161.0 placed the Node asset pipelines behind the Node.js permission model so that code running through PostCSS, Babel, or TailwindCSS could not reach the file system outside the project directory. Hugo 0.162.0 added tailwindcss to the AllowChildProcess default in config/security/securityConfig.go, which makes nodePermissionArgs in common/hexec/exec.go append --allow-child-process whenever the tool being launched is named tailwindcss. TailwindCSS loads the site's tailwind.config.js through require at startup, so top-level code in that file executes inside the permitted Node process and can call child_process to spawn a shell. The spawned process is not a Node process and inherits none of the permission flags, so it runs with the full privileges of the account performing the build. Building a site whose theme, module, or starter template supplies the Tailwind configuration therefore yields arbitrary command execution rather than the confined file access the permission model was introduced to enforce. Hugo 0.165.0 removes tailwindcss from the default security.exec.allow list, so the tool is no longer launched under the default configuration.","evidence":"cve:CVE-2026-75926","products":[{"name":{"value":"hugo","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","structured":{"id":"CVE-2026-75926","aliases":["CVE-2026-75926"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":9.3,"attackVector":"LOCAL","baseSeverity":"CRITICAL","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","userInteraction":"PASSIVE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"HIGH","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","vulnConfidentialityImpact":"HIGH"}},{"format":"CVSS","cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":8.6,"attackVector":"LOCAL","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}}],"affected":[{"repo":"https://github.com/gohugoio/hugo","vendor":"gohugoio","product":"hugo","versions":[{"status":"affected","version":"0.162.0","lessThan":"0.165.0","versionType":"semver"}],"packageURL":"pkg:golang/github.com/gohugoio/hugo","defaultStatus":"unaffected"}],"modified":"2026-09-24T14:19:33.478Z","provider":"cve","references":["https://github.com/gohugoio/hugo/commit/8a55df7af2e6da31297245cc54fa2e3b521d93e8","https://github.com/gohugoio/hugo/issues/15178","https://github.com/gohugoio/hugo/blob/v0.164.0/config/security/securityConfig.go#L72-L79","https://github.com/gohugoio/hugo/blob/v0.164.0/common/hexec/exec.go#L292-L295","https://github.com/gohugoio/hugo","https://www.vulncheck.com/advisories/hugo-to-x-node-permission-model-bypass-via-default-tailwindcss-child-process-grant"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-75926","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-08-19T00:00:00+00:00"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-08-20T03:55:58.115Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-09-24T14:19:33.478Z"}}},"related_cves":[{"value":"CVE-2026-75926","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:b256044d-7a76-4cb7-9c81-8dd27f8af883","priority":{"reasons":["publisher_severity"],"severity":"critical","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"critical"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-75926","advisory_id":"b256044d-7a76-4cb7-9c81-8dd27f8af883","event_types":["advisory"],"published_at":"2026-10-24T20:54:34.650179+00:00","technologies":["core-cve","hugo"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-08-18T15:47:49.048+00:00","detail_url":"/events/985"},"members":[{"id":985,"cve_ids":["CVE-2026-75926"],"payload":{"kind":"advisory","title":"Hugo 0.162.0 to 0.164.x - Node Permission Model Bypass via Default TailwindCSS Child-Process Grant","summary":"Hugo 0.161.0 placed the Node asset pipelines behind the Node.js permission model so that code running through PostCSS, Babel, or TailwindCSS could not reach the file system outside the project directory. Hugo 0.162.0 added tailwindcss to the AllowChildProcess default in config/security/securityConfig.go, which makes nodePermissionArgs in common/hexec/exec.go append --allow-child-process whenever the tool being launched is named tailwindcss. TailwindCSS loads the site's tailwind.config.js through require at startup, so top-level code in that file executes inside the permitted Node process and can call child_process to spawn a shell. The spawned process is not a Node process and inherits none of the permission flags, so it runs with the full privileges of the account performing the build. Building a site whose theme, module, or starter template supplies the Tailwind configuration therefore yields arbitrary command execution rather than the confined file access the permission model was introduced to enforce. Hugo 0.165.0 removes tailwindcss from the default security.exec.allow list, so the tool is no longer launched under the default configuration.","evidence":"cve:CVE-2026-75926","products":[{"name":{"value":"hugo","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","structured":{"id":"CVE-2026-75926","aliases":["CVE-2026-75926"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":9.3,"attackVector":"LOCAL","baseSeverity":"CRITICAL","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","userInteraction":"PASSIVE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"HIGH","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","vulnConfidentialityImpact":"HIGH"}},{"format":"CVSS","cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":8.6,"attackVector":"LOCAL","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}}],"affected":[{"repo":"https://github.com/gohugoio/hugo","vendor":"gohugoio","product":"hugo","versions":[{"status":"affected","version":"0.162.0","lessThan":"0.165.0","versionType":"semver"}],"packageURL":"pkg:golang/github.com/gohugoio/hugo","defaultStatus":"unaffected"}],"modified":"2026-09-24T14:19:33.478Z","provider":"cve","references":["https://github.com/gohugoio/hugo/commit/8a55df7af2e6da31297245cc54fa2e3b521d93e8","https://github.com/gohugoio/hugo/issues/15178","https://github.com/gohugoio/hugo/blob/v0.164.0/config/security/securityConfig.go#L72-L79","https://github.com/gohugoio/hugo/blob/v0.164.0/common/hexec/exec.go#L292-L295","https://github.com/gohugoio/hugo","https://www.vulncheck.com/advisories/hugo-to-x-node-permission-model-bypass-via-default-tailwindcss-child-process-grant"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-75926","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-08-19T00:00:00+00:00"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-08-20T03:55:58.115Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-09-24T14:19:33.478Z"}}},"related_cves":[{"value":"CVE-2026-75926","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:b256044d-7a76-4cb7-9c81-8dd27f8af883","priority":{"reasons":["publisher_severity"],"severity":"critical","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"critical"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-75926","advisory_id":"b256044d-7a76-4cb7-9c81-8dd27f8af883","event_types":["advisory"],"published_at":"2026-10-24T20:54:34.650179+00:00","technologies":["core-cve","hugo"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-08-18T15:47:49.048+00:00","detail_url":"/events/985"}]}}],"next_after":29011,"next_before":991}