Medium
hugo — security advisory
Hugo is a static site generator. Starting in version 0.123.0 and prior to version 0.139.4, some HTML attributes in Markdown in the internal templates listed below not escaped in internal render hooks. Those whoa re impacted are Hugo users who do not trust their Markdown content files and are using one or more of these templates: `_default/_markup/render-link.html` from `v0.123.0`; `_default/_markup/render-image.html` from `v0.123.0`; `_default/_markup/render-table.html` from `v0.134.0`; and/or `shortcodes/youtube.html` from `v0.125.0`. This issue is patched in v0.139.4. As a workaround, one may replace an affected component with user defined templates or disable the internal templates.
- Products
- hugo
- Affected versions
- 0.113.0-3, 0.119.0-2, 0.120.3-1, 0.120.4-1, 0.121.2-1, 0.122.0-1, 0.123.7-1build1, 0.123.7-1ubuntu0.1, 0.123.7-1ubuntu0.2, 0.123.7-1ubuntu0.2+esm1, 0.123.7-1ubuntu0.3, 0.123.7-1ubuntu0.3+esm1, 0.123.7-1ubuntu0.3+esm2, 0.131.0-1, 0.15+git20160109.147.dd1d655-1, 0.15+git20160109.147.dd1d655-2, 0.15+git20160128.179.5def6d9-1, 0.15+git20160206.203.ed23711-1, 0.152.2-1, 0.153.1-3, 0.153.2-1, 0.154.2-2, 0.154.3-1, 0.154.5-1, 0.162.1-5, 0.162.1-7, 0.25.1-2, 0.26-1, 0.35-1, 0.37.1-1, 0.38-1, 0.39-1, 0.40-1, 0.40.1-1, 0.57.2-1, 0.58.3-1, 0.59.1-1.1, 0.68.3-1, 0.80.0-6, 0.89.4-2, 0.90.0-1, 0.90.1-1, 0.91.0-1, 0.91.2-1, 0.92.0-1, 0.92.1-1build1, 0.92.2-1, 0.92.2-1ubuntu0.1
- Fixed versions
- Not specified
- CVEs
- CVE-2024-55601
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 31 Oct 2026, 01:10 UTC · Revision 1
Source evidence
Hugo is a static site generator. Starting in version 0.123.0 and prior to version 0.139.4, some HTML attributes in Markdown in the internal templates listed below not escaped in internal render hooks. Those whoa re impacted are Hugo users who do not trust their Markdown content files and are using one or more of these templates: `_default/_markup/render-link.html` from `v0.123.0`; `_default/_markup/render-image.html` from `v0.123.0`; `_default/_markup/render-table.html` from `v0.134.0`; and/or `shortcodes/youtube.html` from `v0.125.0`. This issue is patched in v0.139.4. As a workaround, one may replace an affected component with user defined templates or disable the internal templates.
osv:UBUNTU-CVE-2024-55601
hugo
Fixed versions: Not specified
hugo
Fixed versions: Not specified
hugo
Fixed versions: Not specified
hugo
Fixed versions: Not specified
hugo
Fixed versions: Not specified
hugo
Fixed versions: Not specified
hugo
Fixed versions: Not specified
hugo
Fixed versions: Not specified
Complete source record
{
"id": "942c35a9c7b3e5d1b906c4c7d253c265951755d94635967fc9f57fadbff097a5",
"url": "https://osv.dev/vulnerability/UBUNTU-CVE-2024-55601",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "UBUNTU-CVE-2024-55601",
"summary": "Hugo is a static site generator. Starting in version 0.123.0 and prior to version 0.139.4, some HTML attributes in Markdown in the internal templates listed below not escaped in internal render hooks. Those whoa re impacted are Hugo users who do not trust their Markdown content files and are using one or more of these templates: `_default/_markup/render-link.html` from `v0.123.0`; `_default/_markup/render-image.html` from `v0.123.0`; `_default/_markup/render-table.html` from `v0.134.0`; and/or `shortcodes/youtube.html` from `v0.125.0`. This issue is patched in v0.139.4. As a workaround, one may replace an affected component with user defined templates or disable the internal templates.",
"evidence": "osv:UBUNTU-CVE-2024-55601",
"products": [
{
"name": {
"value": "hugo",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "0.15+git20160109.147.dd1d655-1",
"evidence": "/affected/0/versions"
},
{
"value": "0.15+git20160109.147.dd1d655-2",
"evidence": "/affected/0/versions"
},
{
"value": "0.15+git20160128.179.5def6d9-1",
"evidence": "/affected/0/versions"
},
{
"value": "0.15+git20160206.203.ed23711-1",
"evidence": "/affected/0/versions"
}
]
},
{
"name": {
"value": "hugo",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "0.25.1-2",
"evidence": "/affected/1/versions"
},
{
"value": "0.26-1",
"evidence": "/affected/1/versions"
},
{
"value": "0.35-1",
"evidence": "/affected/1/versions"
},
{
"value": "0.37.1-1",
"evidence": "/affected/1/versions"
},
{
"value": "0.38-1",
"evidence": "/affected/1/versions"
},
{
"value": "0.39-1",
"evidence": "/affected/1/versions"
},
{
"value": "0.40-1",
"evidence": "/affected/1/versions"
},
{
"value": "0.40.1-1",
"evidence": "/affected/1/versions"
}
]
},
{
"name": {
"value": "hugo",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "0.57.2-1",
"evidence": "/affected/2/versions"
},
{
"value": "0.58.3-1",
"evidence": "/affected/2/versions"
},
{
"value": "0.59.1-1.1",
"evidence": "/affected/2/versions"
},
{
"value": "0.68.3-1",
"evidence": "/affected/2/versions"
}
]
},
{
"name": {
"value": "hugo",
"evidence": "/affected/3/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "0.80.0-6",
"evidence": "/affected/3/versions"
},
{
"value": "0.89.4-2",
"evidence": "/affected/3/versions"
},
{
"value": "0.90.0-1",
"evidence": "/affected/3/versions"
},
{
"value": "0.90.1-1",
"evidence": "/affected/3/versions"
},
{
"value": "0.91.0-1",
"evidence": "/affected/3/versions"
},
{
"value": "0.91.2-1",
"evidence": "/affected/3/versions"
},
{
"value": "0.92.0-1",
"evidence": "/affected/3/versions"
},
{
"value": "0.92.1-1build1",
"evidence": "/affected/3/versions"
},
{
"value": "0.92.2-1",
"evidence": "/affected/3/versions"
},
{
"value": "0.92.2-1ubuntu0.1",
"evidence": "/affected/3/versions"
}
]
},
{
"name": {
"value": "hugo",
"evidence": "/affected/4/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "0.113.0-3",
"evidence": "/affected/4/versions"
},
{
"value": "0.119.0-2",
"evidence": "/affected/4/versions"
},
{
"value": "0.120.3-1",
"evidence": "/affected/4/versions"
},
{
"value": "0.120.4-1",
"evidence": "/affected/4/versions"
},
{
"value": "0.121.2-1",
"evidence": "/affected/4/versions"
},
{
"value": "0.122.0-1",
"evidence": "/affected/4/versions"
},
{
"value": "0.123.7-1build1",
"evidence": "/affected/4/versions"
},
{
"value": "0.123.7-1ubuntu0.1",
"evidence": "/affected/4/versions"
},
{
"value": "0.123.7-1ubuntu0.2",
"evidence": "/affected/4/versions"
},
{
"value": "0.123.7-1ubuntu0.2+esm1",
"evidence": "/affected/4/versions"
},
{
"value": "0.123.7-1ubuntu0.3",
"evidence": "/affected/4/versions"
},
{
"value": "0.123.7-1ubuntu0.3+esm1",
"evidence": "/affected/4/versions"
},
{
"value": "0.123.7-1ubuntu0.3+esm2",
"evidence": "/affected/4/versions"
}
]
},
{
"name": {
"value": "hugo",
"evidence": "/affected/5/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "0.131.0-1",
"evidence": "/affected/5/versions"
}
]
},
{
"name": {
"value": "hugo",
"evidence": "/affected/6/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "0.154.5-1",
"evidence": "/affected/6/versions"
},
{
"value": "0.162.1-5",
"evidence": "/affected/6/versions"
},
{
"value": "0.162.1-7",
"evidence": "/affected/6/versions"
}
]
},
{
"name": {
"value": "hugo",
"evidence": "/affected/7/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "0.131.0-1",
"evidence": "/affected/7/versions"
},
{
"value": "0.152.2-1",
"evidence": "/affected/7/versions"
},
{
"value": "0.153.1-3",
"evidence": "/affected/7/versions"
},
{
"value": "0.153.2-1",
"evidence": "/affected/7/versions"
},
{
"value": "0.154.2-2",
"evidence": "/affected/7/versions"
},
{
"value": "0.154.3-1",
"evidence": "/affected/7/versions"
},
{
"value": "0.154.5-1",
"evidence": "/affected/7/versions"
}
]
}
],
"severity": "medium",
"structured": {
"id": "UBUNTU-CVE-2024-55601",
"aliases": [
"UBUNTU-CVE-2024-55601"
],
"metrics": [
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N"
},
{
"type": "Ubuntu",
"score": "medium"
}
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "hugo",
"purl": "pkg:deb/ubuntu/hugo?arch=source&distro=xenial",
"ecosystem": "Ubuntu:16.04:LTS"
},
"versions": [
"0.15+git20160109.147.dd1d655-1",
"0.15+git20160109.147.dd1d655-2",
"0.15+git20160128.179.5def6d9-1",
"0.15+git20160206.203.ed23711-1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2024/UBUNTU-CVE-2024-55601.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "golang-github-spf13-hugo-dev",
"binary_version": "0.15+git20160206.203.ed23711-1"
},
{
"binary_name": "hugo",
"binary_version": "0.15+git20160206.203.ed23711-1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "hugo",
"purl": "pkg:deb/ubuntu/hugo?arch=source&distro=bionic",
"ecosystem": "Ubuntu:18.04:LTS"
},
"versions": [
"0.25.1-2",
"0.26-1",
"0.35-1",
"0.37.1-1",
"0.38-1",
"0.39-1",
"0.40-1",
"0.40.1-1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2024/UBUNTU-CVE-2024-55601.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "golang-github-gohugoio-hugo-dev",
"binary_version": "0.40.1-1"
},
{
"binary_name": "hugo",
"binary_version": "0.40.1-1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "hugo",
"purl": "pkg:deb/ubuntu/hugo?arch=source&distro=focal",
"ecosystem": "Ubuntu:20.04:LTS"
},
"versions": [
"0.57.2-1",
"0.58.3-1",
"0.59.1-1.1",
"0.68.3-1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2024/UBUNTU-CVE-2024-55601.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "hugo",
"binary_version": "0.68.3-1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "hugo",
"purl": "pkg:deb/ubuntu/hugo?arch=source&distro=jammy",
"ecosystem": "Ubuntu:22.04:LTS"
},
"versions": [
"0.80.0-6",
"0.89.4-2",
"0.90.0-1",
"0.90.1-1",
"0.91.0-1",
"0.91.2-1",
"0.92.0-1",
"0.92.1-1build1",
"0.92.2-1",
"0.92.2-1ubuntu0.1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2024/UBUNTU-CVE-2024-55601.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "hugo",
"binary_version": "0.92.2-1ubuntu0.1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "hugo",
"purl": "pkg:deb/ubuntu/hugo?arch=source&distro=esm-apps%2Fnoble",
"ecosystem": "Ubuntu:Pro:24.04:LTS"
},
"versions": [
"0.113.0-3",
"0.119.0-2",
"0.120.3-1",
"0.120.4-1",
"0.121.2-1",
"0.122.0-1",
"0.123.7-1build1",
"0.123.7-1ubuntu0.1",
"0.123.7-1ubuntu0.2",
"0.123.7-1ubuntu0.2+esm1",
"0.123.7-1ubuntu0.3",
"0.123.7-1ubuntu0.3+esm1",
"0.123.7-1ubuntu0.3+esm2"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2024/UBUNTU-CVE-2024-55601.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "hugo",
"binary_version": "0.123.7-1ubuntu0.3+esm2"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "hugo",
"purl": "pkg:deb/ubuntu/hugo?arch=source&distro=questing",
"ecosystem": "Ubuntu:25.10"
},
"versions": [
"0.131.0-1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2024/UBUNTU-CVE-2024-55601.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "hugo",
"binary_version": "0.131.0-1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "hugo",
"purl": "pkg:deb/ubuntu/hugo?arch=source&distro=stonking",
"ecosystem": "Ubuntu:26.10"
},
"versions": [
"0.154.5-1",
"0.162.1-5",
"0.162.1-7"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2024/UBUNTU-CVE-2024-55601.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "hugo",
"binary_version": "0.162.1-7"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "hugo",
"purl": "pkg:deb/ubuntu/hugo?arch=source&distro=resolute",
"ecosystem": "Ubuntu:26.04:LTS"
},
"versions": [
"0.131.0-1",
"0.152.2-1",
"0.153.1-3",
"0.153.2-1",
"0.154.2-2",
"0.154.3-1",
"0.154.5-1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2024/UBUNTU-CVE-2024-55601.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "hugo",
"binary_version": "0.154.5-1"
}
]
}
}
],
"modified": "2026-10-17T12:56:40.483677008Z",
"provider": "osv",
"upstream": [
"CVE-2024-55601"
],
"references": [
"https://ubuntu.com/security/CVE-2024-55601",
"https://www.cve.org/CVERecord?id=CVE-2024-55601",
"https://github.com/gohugoio/hugo/security/advisories/GHSA-c2xf-9v2r-r2rx",
"https://github.com/gohugoio/hugo/commit/54398f8d572c689f9785d59e907fd910a23401b0",
"https://github.com/gohugoio/hugo/releases/tag/v0.139.4",
"https://gohugo.io/getting-started/configuration-markup/#renderhooksimageenabledefault"
]
},
"related_cves": [
{
"value": "CVE-2024-55601",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 355942,
"published_at": "2024-12-09T22:15:00+00:00"
}