These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
A regression in Hugo, a static site generator, from version 0.123.0 to 0.161.1, caused the RootMappingFs.statRoot function to use Stat (which follows symlinks) instead of Lstat. This change allowed a direct resources.Get of a symlink pointing outside its mount to return the target's contents. Consequently, a symlink planted in a local mount, such as a vendored themes/ theme, could be used to read arbitrar [truncated]
A vulnerability in Hugo, a static site generator, was discovered that allows for unauthorized server-side requests. The issue, CVE-2026-58404, exists from version 0.162.0 through 0.163.0 and is fixed in version 0.163.1. This vulnerability allows attackers to bypass security restrictions and access internal services. Users of Hugo static site generator, especially those using versions between 0.162.0 and 0 [truncated]
CVE-2026-58403 is a MEDIUM severity vulnerability in Hugo's virtual filesystem. A regression in Hugo versions from v0.123.0 through v0.163.0 allowed a symlink planted inside a theme or local mount to read arbitrary files reachable to the user running Hugo. This issue is fixed in v0.163.1. The vulnerability was caused by a regression that led to RootMappingFs.statRoot calling Stat, which follows symlinks, [truncated]
A vulnerability in Hugo, a static site generator, allows for code injection via Markdown code-fence language or info-string. The issue, fixed in version 0.163.3, arises from the default code-block renderer writing the Markdown code-fence language or info-string into the code class=language-… data-lang=… wrapper without HTML escaping. A fence info-string containing a quote and a script payload can break ou [truncated]
CVE-2026-50134 is a vulnerability in the Hugo static site generator that allows for a security bypass via HTTP 3xx redirects. The vulnerability exists in versions from 0.91.0 until 0.162.0 of the Hugo software. The resources.GetRemote function enforces security.http.urls on the URL it is called with, but it did not re-validate intermediate URLs on HTTP 3xx redirects. This allows an allowed server or an at [truncated]
CVE-2026-50133 is a stored cross-site scripting vulnerability in Hugo, a static site generator. Prior to version 0.162.0, Hugo accepts content files in several markup formats. Files mapped to the text/html media type had their body emitted verbatim into the rendered page. A site that ingests HTML content from an untrusted source could therefore be served stored cross-site scripting.