Go/github.com/gohugoio/hugo CVE-2026-35166: unknown, EPSS 0.23%
Hugo: Certain markdown links are not properly escaped in github.com/gohugoio/hugo
Action: Upgrade github.com/gohugoio/hugo to 0.159.2 or later.
go get github.com/gohugoio/hugo@v0.159.2Affected
| introduced | fixed | last affected |
|---|---|---|
| 0.60.0 | 0.159.2 | - |
Fixed versions
| 0.159.2 |
Sources
- osv: GO-2026-5504
- https://github.com/gohugoio/hugo/security/advisories/GHSA-mcv8-8m8x-48pg
- https://github.com/gohugoio/hugo/commit/479fe6c654937a850b65e74551dc4e857d52898f
CVE-2026-35166 · published · modified · JSON