PatchTheCVEhugo vulnerabilities and fixes
Recent CVEs affecting hugo, with upgrade or downgrade steps. 2 tracked.
hugo has 2 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 2. Most recent: 2026-08-18. Highest priority: CVE-2026-75926 (score 40/100).
- CVE-2026-35166 MEDIUM 5.4 UPGRADE UPGRADE Hugo is a static site generator
- CVE-2026-75926 HIGH 8.6 UPGRADE Hugo 0.161.0 placed the Node asset pipelines behind the Node.js permission model so that code running through
FAQ
How do I fix hugo vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is hugo being exploited right now?
None of the tracked hugo CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which hugo CVE should I patch first?
CVE-2026-75926 currently ranks highest (40/100): Hugo 0.161.0 placed the Node asset pipelines behind the Node.js permission model so that code running through .