Go/github.com/gohugoio/hugo CVE-2026-35166: medium 5.4, EPSS 0.18%
Hugo: Certain markdown links are not properly escaped
Action: Upgrade github.com/gohugoio/hugo to 0.159.2 or later.
go get github.com/gohugoio/hugo@v0.159.2Affected
| introduced | fixed | last affected |
|---|---|---|
| 0.60.0 | 0.159.2 | - |
Fixed versions
| 0.159.2 |
Sources
- osv: GHSA-mcv8-8m8x-48pg
- nvd: CVE-2026-35166
- https://github.com/gohugoio/hugo/security/advisories/GHSA-mcv8-8m8x-48pg
- https://github.com/gohugoio/hugo/commit/479fe6c654937a850b65e74551dc4e857d52898f
- https://github.com/gohugoio/hugo
CVE-2026-35166 · published · modified · JSON