https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T10:13:23.433200+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-206621 EUVD-2026-206621 2026-10-03T10:13:23.498362+00:00 EUVD-2026-206621 https://cve.radiocsirt.org/vuln/fkie_cve-2024-55601 fkie_cve-2024-55601 2026-10-03T10:13:23.498400+00:00

Hugo is a static site generator. Starting in version 0.123.0 and prior to version 0.139.4, some HTML attributes in Markdown in the internal templates listed below not escaped in internal render hooks. Those whoa re impacted are Hugo users who do not trust their Markdown content files and are using one or more of these templates: `_default/_markup/render-link.html` from `v0.123.0`; `_default/_markup/render-image.html` from `v0.123.0`; `_default/_markup/render-table.html` from `v0.134.0`; and/or `shortcodes/youtube.html` from `v0.125.0`. This issue is patched in v0.139.4. As a workaround, one may replace an affected component with user defined templates or disable the internal templates.

 https://cve.radiocsirt.org/vuln/ghsa-c2xf-9v2r-r2rx GHSA-c2xf-9v2r-r2rx — Hugo does not escape some attributes in internal templates 2026-10-03T10:13:23.498437+00:00

Affected: Go: github.com/gohugoio/hugo

## Impact

Some HTML attributes in Markdown in the internal templates listed below not escaped. Impacted are Hugo users who do not trust their Markdown content files and are using one or more of these templates.

* `_default/_markup/render-link.html` from `v0.123.0` * `_default/_markup/render-image.html` from `v0.123.0` * `_default/_markup/render-table.html` from `v0.134.0` * `shortcodes/youtube.html` from `v0.125.0`

## Patches

Patched in v0.139.4.

## Workarounds

Replace with user defined templates or disable the internal templates: https://gohugo.io/getting-started/configuration-markup/#renderhooksimageenabledefault

## References

* https://github.com/gohugoio/hugo/releases/tag/v0.139.4 * https://gohugo.io/about/security/

 https://cve.radiocsirt.org/vuln/opensuse-su-2024:14599-1 openSUSE-SU-2024:14599-1 — govulncheck-vulndb-0.0.20241213T205935-1.1 on GA media 2026-10-03T10:13:23.498472+00:00

govulncheck-vulndb-0.0.20241213T205935-1.1 on GA media

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2024-55601 UBUNTU-CVE-2024-55601 2026-10-03T10:13:23.498500+00:00

Affected: Ubuntu:16.04:LTS: hugo, Ubuntu:18.04:LTS: hugo, Ubuntu:20.04:LTS: hugo, Ubuntu:22.04:LTS: hugo, Ubuntu:Pro:24.04:LTS: hugo, Ubuntu:25.10: hugo, Ubuntu:26.04:LTS: hugo

Hugo is a static site generator. Starting in version 0.123.0 and prior to version 0.139.4, some HTML attributes in Markdown in the internal templates listed below not escaped in internal render hooks. Those whoa re impacted are Hugo users who do not trust their Markdown content files and are using one or more of these templates: `_default/_markup/render-link.html` from `v0.123.0`; `_default/_markup/render-image.html` from `v0.123.0`; `_default/_markup/render-table.html` from `v0.134.0`; and/or `shortcodes/youtube.html` from `v0.125.0`. This issue is patched in v0.139.4. As a workaround, one may replace an affected component with user defined templates or disable the internal templates.