`github.com/gohugoio/hugo`

Ecosystem:
go

Package URL:
pkg:golang/github.com/gohugoio/hugo

Total PRs:
250 Dependabot PRs

Latest PR:
14 days ago

Unique Repositories:
46 repositories

Unique Repos (30 days):
3 repositories

Security Advisories

Hugo can execute a binary from the current directory on Windows

GHSA-8j34-9876-pvfq CVE-2020-26284 HIGH published almost 5 years ago • updated 6 days ago

## Impact Hugo depends on Go's `os/exec` for certain features, e.g. for rendering of Pandoc documents if these binaries are found in the system `%...

Hugo: Certain markdown links are not properly escaped

GHSA-mcv8-8m8x-48pg CVE-2026-35166 MODERATE published 2 months ago • updated 10 days ago

### Impact Links and image links in the default markdown to HTML renderer are not properly escaped. Hugo users who trust their Markdown content or ...

Hugo Markdown titles do not escaped in internal render hooks

GHSA-ppf8-hhpp-f5hj CVE-2024-32875 MODERATE published about 2 years ago • updated 8 days ago

### Impact Title argument in Markdown for links and images not escaped in internal render hooks. Impacted are Hugo users who have these hooks enab...

Hugo does not escape some attributes in internal templates

GHSA-c2xf-9v2r-r2rx CVE-2024-55601 MODERATE published over 1 year ago • updated 8 days ago

## Impact Some HTML attributes in Markdown in the internal templates listed below not escaped. Impacted are Hugo users who do not trust their Mark...

Hugo's Node tool execution allows file system access outside the project directory

GHSA-x597-9fr4-5857 CVE-2026-44301 MODERATE published about 1 month ago • updated 10 days ago

## Impact When building a Hugo site that uses Node-based asset pipelines (PostCSS, Babel, TailwindCSS), Hugo invoked the configured Node tools wit...

Recent PRs (filtered by: Patch PRs )

RSS Feed Clear filter

Bump github.com/gohugoio/hugo from 0.155.2 to 0.155.3 in /hack/tools

kubernetes-sigs/kueue #9216

0.155.2 → 0.155.3 Patch PR

Open 4 months ago 6 comments

Bump github.com/gohugoio/hugo from 0.154.2 to 0.154.5 in /hack/internal/tools

kubernetes-sigs/kueue #8536

0.154.2 → 0.154.5 Patch PR

Open 5 months ago 8 comments

chore(deps): bump github.com/gohugoio/hugo from 0.154.1 to 0.154.2

golanglib/dependabot_botherer #8466

0.154.1 → 0.154.2 Patch PR

Open 5 months ago 1 comment

chore(deps): bump github.com/gohugoio/hugo from 0.153.1 to 0.153.2

golanglib/dependabot_botherer #8313

0.153.1 → 0.153.2 Patch PR

Closed 6 months ago 1 comment

chore(deps): bump github.com/gohugoio/hugo from 0.150.0 to 0.150.1

golanglib/dependabot_botherer #5967

0.150.0 → 0.150.1 Patch PR

Open 9 months ago

chore(deps): bump github.com/gohugoio/hugo from 0.149.0 to 0.149.1

golanglib/dependabot_botherer #5364

0.149.0 → 0.149.1 Patch PR

Merged 9 months ago

chore(deps): Bump github.com/gohugoio/hugo from 0.149.0 to 0.149.1

zerok/zerokspot.com #988

0.149.0 → 0.149.1 Patch PR

Merged 9 months ago

build(deps): bump the dependencies group in /api with 92 updates

and-period/furumaru #2960

0.148.1 → 0.148.2 Patch PR

Open 10 months ago 3 comments

build(deps): bump the dependencies group across 1 directory with 91 updates

and-period/furumaru #2955

0.148.1 → 0.148.2 Patch PR

Closed 10 months ago 4 comments

build(deps): bump the dependencies group across 1 directory with 86 updates

and-period/furumaru #2950

0.148.1 → 0.148.2 Patch PR

Open 10 months ago

build(deps): bump the dependencies group across 1 directory with 67 updates

and-period/furumaru #2911

0.148.1 → 0.148.2 Patch PR

Merged 10 months ago 3 comments

build(deps): bump the dependencies group across 1 directory with 55 updates

and-period/furumaru #2909

0.148.1 → 0.148.2 Patch PR

Closed 10 months ago 4 comments

build(deps): bump the dependencies group across 1 directory with 52 updates

and-period/furumaru #2904

0.148.1 → 0.148.2 Patch PR

Closed 10 months ago 4 comments

build(deps): bump the dependencies group across 1 directory with 51 updates

and-period/furumaru #2902

0.148.1 → 0.148.2 Patch PR

Closed 10 months ago 2 comments

build(deps): bump the dependencies group in /api with 45 updates

and-period/furumaru #2897

0.148.1 → 0.148.2 Patch PR

Closed 10 months ago 4 comments

chore(deps): bump github.com/gohugoio/hugo from 0.148.1 to 0.148.2

golanglib/dependabot_botherer #4249

0.148.1 → 0.148.2 Patch PR

Open 11 months ago

chore(deps): Bump github.com/gohugoio/hugo from 0.148.1 to 0.148.2

zerok/zerokspot.com #963

0.148.1 → 0.148.2 Patch PR

Merged 11 months ago

go(deps): bump github.com/gohugoio/hugo from 0.148.1 to 0.148.2

NordGus/financo #408

0.148.1 → 0.148.2 Patch PR

Merged 11 months ago

chore(deps): bump github.com/gohugoio/hugo from 0.148.0 to 0.148.1

golanglib/dependabot_botherer #3905

0.148.0 → 0.148.1 Patch PR

Merged 11 months ago

chore(deps): Bump github.com/gohugoio/hugo from 0.148.0 to 0.148.1

zerok/zerokspot.com #954

0.148.0 → 0.148.1 Patch PR

Merged 11 months ago

go(deps): bump github.com/gohugoio/hugo from 0.147.6 to 0.147.9

NordGus/financo #285

0.147.6 → 0.147.9 Patch PR

Merged 11 months ago

Bump github.com/gohugoio/hugo from 0.147.7 to 0.147.9 in /hack/internal/tools

sgl-project/ome #66

0.147.7 → 0.147.9 Patch PR

Open 12 months ago 1 comment

chore(deps): bump github.com/gohugoio/hugo from 0.147.8 to 0.147.9

golanglib/dependabot_botherer #3502

0.147.8 → 0.147.9 Patch PR

Merged 12 months ago

build(deps): bump the dependencies group in /api with 45 updates

and-period/furumaru #2851

0.147.7 → 0.147.8 Patch PR

Open 12 months ago 1 comment

chore(deps): Bump github.com/gohugoio/hugo from 0.147.7 to 0.147.8

zerok/zerokspot.com #933

0.147.7 → 0.147.8 Patch PR

Merged about 1 year ago

build(deps): bump the dependencies group in /api with 23 updates

and-period/furumaru #2833

0.147.6 → 0.147.7 Patch PR

Open about 1 year ago 2 comments

Bump github.com/gohugoio/hugo from 0.147.6 to 0.147.7 in /hack/internal/tools

kubernetes-sigs/kueue #5444

0.147.6 → 0.147.7 Patch PR

Open about 1 year ago

build(deps): bump the dependencies group across 1 directory with 44 updates

and-period/furumaru #2830

0.147.2 → 0.147.6 Patch PR

Open about 1 year ago

Bump github.com/gohugoio/hugo from 0.147.5 to 0.147.6 in /hack/internal/tools

kubernetes-sigs/kueue #5392

0.147.5 → 0.147.6 Patch PR

Open about 1 year ago 6 comments

chore(deps): bump github.com/gohugoio/hugo from 0.147.5 to 0.147.6

golanglib/dependabot_botherer #2989

0.147.5 → 0.147.6 Patch PR

Merged about 1 year ago

chore(deps): Bump github.com/gohugoio/hugo from 0.147.5 to 0.147.6

zerok/zerokspot.com #922

0.147.5 → 0.147.6 Patch PR

Closed about 1 year ago 1 comment

Bump github.com/gohugoio/hugo from 0.147.3 to 0.147.5 in /hack/internal/tools

kubernetes-sigs/kueue #5345

0.147.3 → 0.147.5 Patch PR

Open about 1 year ago

chore(deps): bump github.com/gohugoio/hugo from 0.147.4 to 0.147.5

golanglib/dependabot_botherer #2933

0.147.4 → 0.147.5 Patch PR

Merged about 1 year ago

chore(deps): Bump github.com/gohugoio/hugo from 0.147.3 to 0.147.5

zerok/zerokspot.com #921

0.147.3 → 0.147.5 Patch PR

Merged about 1 year ago

build(deps): bump the dependencies group across 1 directory with 33 updates

and-period/furumaru #2818

0.147.2 → 0.147.4 Patch PR

Open about 1 year ago

chore(deps): bump github.com/gohugoio/hugo from 0.147.3 to 0.147.4

golanglib/dependabot_botherer #2901

0.147.3 → 0.147.4 Patch PR

Merged about 1 year ago

chore(deps): Bump github.com/gohugoio/hugo from 0.147.3 to 0.147.4

zerok/zerokspot.com #919

0.147.3 → 0.147.4 Patch PR

Open about 1 year ago

chore(deps): bump github.com/gohugoio/hugo from 0.147.0 to 0.147.3

golanglib/dependabot_botherer #2881

0.147.0 → 0.147.3 Patch PR

Open about 1 year ago

Bump github.com/gohugoio/hugo from 0.147.2 to 0.147.3 in /hack/internal/tools

kubernetes-sigs/kueue #5283

0.147.2 → 0.147.3 Patch PR

Open about 1 year ago

build(deps): bump the dependencies group in /api with 19 updates

and-period/furumaru #2816

0.147.2 → 0.147.3 Patch PR

Closed about 1 year ago 3 comments

chore(deps): Bump github.com/gohugoio/hugo from 0.147.2 to 0.147.3

zerok/zerokspot.com #915

0.147.2 → 0.147.3 Patch PR

Merged about 1 year ago

Package Details

Name:	`github.com/gohugoio/hugo`
Ecosystem:	go
PURL Type:	golang
Package URL:	`pkg:golang/github.com/gohugoio/hugo`
JSON API:	View JSON

Security Advisories

5

Active advisories

HIGH 1

MODERATE 4

View All golang Advisories

Package Information

Description:

Repository:	https://github.com/gohugoio/hugo
Homepage:	https://github.com/gohugoio/hugo
Latest Release:	`v0.147.7` about 1 year ago
Dependent Repos:	210
Dependent Packages:	232
Ranking:	Top 0.4395% by dependent repos Top 0.3199% by dependent pkgs

PR Status

Open 77 (30.8%)

Merged 31 (12.4%)

Closed 102 (40.8%)

PR Types

Minor 169 (67.6%)

Patch 41 (16.4%)