GO-2026-5740
- Source
- https://pkg.go.dev/vuln/GO-2026-5740
- Import Source
- https://vuln.go.dev/ID/GO-2026-5740.json
- JSON Data
- https://api.osv.dev/v1/vulns/GO-2026-5740
- Aliases
- Published
- 2026-07-24T18:35:55Z
- Modified
- 2026-07-24T19:00:25.653470716Z
- Summary
- Hugo's Node tool execution allows file system access outside the project directory in github.com/gohugoio/hugo
- Details
-
Hugo's Node tool execution allows file system access outside the project directory in github.com/gohugoio/hugo
- Database specific
{ "review_status": "REVIEWED", "url": "https://pkg.go.dev/vuln/GO-2026-5740" }- References
Affected packages
Go / github.com/gohugoio/hugo
Package
- Name
- github.com/gohugoio/hugo
- View open source insights on deps.dev
- Purl
- pkg:golang/github.com/gohugoio/hugo
Affected ranges
- Type
- SEMVER
- Events
-
Introduced0Unknown introduced version / All previous versions are affectedFixed0.161.0
Ecosystem specific
{
"imports": [
{
"path": "github.com/gohugoio/hugo/config/security",
"symbols": [
"DecodeConfig"
]
},
{
"path": "github.com/gohugoio/hugo/common/hexec",
"symbols": [
"Exec.Npx",
"New"
]
},
{
"path": "github.com/gohugoio/hugo/resources/resource_transformers/babel",
"symbols": [
"DecodeOptions",
"New",
"babelTransformation.Transform"
]
},
{
"path": "github.com/gohugoio/hugo/common/hugo",
"symbols": [
"GetExecEnviron"
]
},
{
"path": "github.com/gohugoio/hugo/deps",
"symbols": [
"Deps.Clone",
"Deps.Init"
]
}
],
"custom_ranges": [
{
"events": [
{
"introduced": "0.43.0"
}
],
"type": "ECOSYSTEM"
}
]
}