https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-08T08:31:03.438487+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-5194 EUVD-2026-5194 2026-10-08T08:31:03.442197+00:00 EUVD-2026-5194 https://cve.radiocsirt.org/vuln/fkie_cve-2024-32875 fkie_cve-2024-32875 2026-10-08T08:31:03.442239+00:00

Hugo is a static site generator. Starting in version 0.123.0 and prior to version 0.125.3, title arguments in Markdown for links and images not escaped in internal render hooks. Hugo users who are impacted are those who have these hooks enabled and do not trust their Markdown content files. The issue is patched in v0.125.3. As a workaround, replace the templates with user defined templates or disable the internal templates.

 https://cve.radiocsirt.org/vuln/ghsa-ppf8-hhpp-f5hj GHSA-ppf8-hhpp-f5hj — Hugo Markdown titles do not escaped in internal render hooks 2026-10-08T08:31:03.442275+00:00

Affected: Go: github.com/gohugoio/hugo

### Impact

Title argument in Markdown for links and images not escaped in internal render hooks. Impacted are Hugo users who have these hooks enabled and do not trust their Markdown content files.

### Patches

Patched in v0.125.3.

### Workarounds

Replace with user defined templates or disable the internal templates: https://gohugo.io/getting-started/configuration-markup/#renderhooksimageenabledefault

### References

https://github.com/gohugoio/hugo/releases/tag/v0.125.3

 https://cve.radiocsirt.org/vuln/gsd-2024-32875 gsd-2024-32875 2026-10-08T08:31:03.442307+00:00 gsd-2024-32875 https://cve.radiocsirt.org/vuln/ubuntu-cve-2024-32875 UBUNTU-CVE-2024-32875 2026-10-08T08:31:03.442320+00:00

Affected: Ubuntu:16.04:LTS: hugo, Ubuntu:18.04:LTS: hugo, Ubuntu:20.04:LTS: hugo, Ubuntu:22.04:LTS: hugo, Ubuntu:Pro:24.04:LTS: hugo, Ubuntu:25.10: hugo, Ubuntu:26.04:LTS: hugo

Hugo is a static site generator. Starting in version 0.123.0 and prior to version 0.125.3, title arguments in Markdown for links and images not escaped in internal render hooks. Hugo users who are impacted are those who have these hooks enabled and do not trust their Markdown content files. The issue is patched in v0.125.3. As a workaround, replace the templates with user defined templates or disable the internal templates.