PatchTheCVEgohugo vulnerabilities
Recent CVEs affecting gohugo products. 2 tracked.
gohugo has 2 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 2. Most recent: 2026-08-18. Highest priority: CVE-2026-75926 (score 40/100).
- CVE-2026-35166 MEDIUM 5.4 UPGRADE UPGRADE Hugo is a static site generator
- CVE-2026-75926 HIGH 8.6 UPGRADE Hugo 0.161.0 placed the Node asset pipelines behind the Node.js permission model so that code running through
FAQ
How do I fix gohugo vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is gohugo being exploited right now?
None of the tracked gohugo CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which gohugo CVE should I patch first?
CVE-2026-75926 currently ranks highest (40/100): Hugo 0.161.0 placed the Node asset pipelines behind the Node.js permission model so that code running through .