RHSA-2026:66266
Vulnerability from csaf_redhat - Published: 2026-09-09 23:14 - Updated: 2026-09-29 19:01Summary
Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update
Severity
Important
Notes
Topic: An update for Red Hat Hardened Images RPMs is now available.
Details: This update includes the following RPMs:
hugo:
* hugo-0.166.0-0.1.hum1 (aarch64, x86_64)
* hugo-0.166.0-0.1.hum1.src (src)
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in Hugo. The `security.http.urls` allowlist, which controls outbound fetches, does not adequately validate the destination address of URLs. This vulnerability allows a remote attacker to supply a specially crafted URL that resolves to internal network resources. As a result, the Hugo build process can fetch internal endpoints, and the sensitive response data may be embedded and published within the generated static site, leading to information disclosure.
7.4 (High)
Affected products
Fixed
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Hardened Images:hugo-0:0.166.0-0.1.hum1@aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Hardened Images:hugo-0:0.166.0-0.1.hum1@src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Hardened Images:hugo-0:0.166.0-0.1.hum1@x86_64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in Hugo's default fenced-code-block renderer. This vulnerability allows a remote attacker to inject arbitrary script code into the rendered HTML by providing specially crafted input in the code-fence info string. Due to improper escaping of attribute values, a malicious quote can terminate an attribute and allow the injection of additional attributes, including event handlers. This can lead to client-side arbitrary code execution when a user views the affected page.
5.4 (Medium)
Affected products
Fixed
3 products, the same list as for
CVE-2026-10582
Threats
Impact
Moderate
A flaw was found in golang.org/x/image. A remote attacker could exploit this vulnerability by providing a specially crafted font file. Parsing this malicious file can lead to excessive memory allocation, which may result in a Denial of Service (DoS) for the affected system.
6.1 (Medium)
Affected products
Fixed
3 products, the same list as for
CVE-2026-10582
Threats
Impact
Moderate
A flaw was found in Hugo. This vulnerability allows information disclosure when Hugo executes build tools under the Node.js permission model, which validates only lexical file paths and fails to restrict symbolic links pointing outside the sandbox. An attacker capable of contributing content to a repository can exploit this by committing a symbolic link targeting sensitive host files alongside a build tool that reads it. Consequently, files readable by the build process can be exposed and embedded into the published site.
5.5 (Medium)
Affected products
Fixed
3 products, the same list as for
CVE-2026-10582
Threats
Impact
Moderate
A flaw was found in Hugo. The syntax highlighter fails to properly sanitize the lineAnchors option, resulting in a stored Cross-Site Scripting (XSS) vulnerability. A remote attacker capable of submitting Markdown content can exploit this by supplying a crafted lineAnchors code block attribute. When the site is generated and published, this flaw allows arbitrary script execution in the browsers of users visiting the affected pages.
5.4 (Medium)
Affected products
Fixed
3 products, the same list as for
CVE-2026-10582
Threats
Impact
Moderate
A flaw was found in Hugo. This vulnerability enables information disclosure when building a site that includes a crafted theme or vendored module. Because Hugo fails to properly restrict symbolic links (symlinks) at mount roots, links pointing to directories outside the project directory are traversed. Consequently, unauthorized files from the host system can be read during site generation and published into the public output directory.
5.5 (Medium)
Affected products
Fixed
3 products, the same list as for
CVE-2026-10582
Threats
Impact
Moderate
A flaw was found in Hugo. Case-sensitive validation in the URL deny rule mechanism allows an attacker to bypass access restrictions. By supplying mixed-case URL schemes when fetching remote resources, an attacker can access restricted network destinations, such as localhost or internal IP addresses. This may lead to unauthorized access to internal network services and information disclosure.
4.0 (Medium)
Affected products
Fixed
3 products, the same list as for
CVE-2026-10582
Threats
Impact
Moderate
A flaw was found in Hugo. When processing content files mapped to the Org Mode media type, Hugo renders raw HTML export blocks and snippets without proper escaping. An attacker who can influence or supply content files can exploit this vulnerability to conduct cross-site scripting (XSS), executing malicious scripts in the web browsers of users viewing the generated site.
6.1 (Medium)
Affected products
Fixed
3 products, the same list as for
CVE-2026-10582
Threats
Impact
Moderate
References
66 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for Red Hat Hardened Images RPMs is now available.",
"title": "Topic"
},
{
"category": "general",
"text": "This update includes the following RPMs:\n\nhugo:\n * hugo-0.166.0-0.1.hum1 (aarch64, x86_64)\n * hugo-0.166.0-0.1.hum1.src (src)",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:66266",
"url": "https://access.redhat.com/errata/RHSA-2026:66266"
},
{
"category": "external",
"summary": "https://images.redhat.com/",
"url": "https://images.redhat.com/"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-10618",
"url": "https://access.redhat.com/security/cve/CVE-2026-10618"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/",
"url": "https://access.redhat.com/security/updates/classification/"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-10582",
"url": "https://access.redhat.com/security/cve/CVE-2026-10582"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-44301",
"url": "https://access.redhat.com/security/cve/CVE-2026-44301"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-33812",
"url": "https://access.redhat.com/security/cve/CVE-2026-33812"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-100693",
"url": "https://access.redhat.com/security/cve/CVE-2026-100693"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-100690",
"url": "https://access.redhat.com/security/cve/CVE-2026-100690"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-100694",
"url": "https://access.redhat.com/security/cve/CVE-2026-100694"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-100692",
"url": "https://access.redhat.com/security/cve/CVE-2026-100692"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-100691",
"url": "https://access.redhat.com/security/cve/CVE-2026-100691"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_66266.json"
}
],
"title": "Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update",
"tracking": {
"current_release_date": "2026-09-29T19:01:41+00:00",
"generator": {
"date": "2026-09-29T19:01:41+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.4.0"
}
},
"id": "RHSA-2026:66266",
"initial_release_date": "2026-09-09T23:14:36+00:00",
"revision_history": [
{
"date": "2026-09-09T23:14:36+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-09-26T15:12:47+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-09-29T19:01:41+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Hardened Images",
"product": {
"name": "Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:hummingbird:1"
}
}
}
],
"category": "product_family",
"name": "Red Hat Hardened Images"
},
{
"branches": [
{
"category": "product_version",
"name": "hugo-0:0.166.0-0.1.hum1@aarch64",
"product": {
"name": "hugo-0:0.166.0-0.1.hum1@aarch64",
"product_id": "hugo-0:0.166.0-0.1.hum1@aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/hugo@0.166.0-0.1.hum1?arch=aarch64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
}
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "hugo-0:0.166.0-0.1.hum1@src",
"product": {
"name": "hugo-0:0.166.0-0.1.hum1@src",
"product_id": "hugo-0:0.166.0-0.1.hum1@src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/hugo@0.166.0-0.1.hum1?arch=src\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-source-rpms"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "hugo-0:0.166.0-0.1.hum1@x86_64",
"product": {
"name": "hugo-0:0.166.0-0.1.hum1@x86_64",
"product_id": "hugo-0:0.166.0-0.1.hum1@x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/hugo@0.166.0-0.1.hum1?arch=x86_64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
}
}
}
],
"category": "architecture",
"name": "x86_64"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "hugo-0:0.166.0-0.1.hum1@aarch64 as a component of Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images:hugo-0:0.166.0-0.1.hum1@aarch64"
},
"product_reference": "hugo-0:0.166.0-0.1.hum1@aarch64",
"relates_to_product_reference": "Red Hat Hardened Images"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "hugo-0:0.166.0-0.1.hum1@src as a component of Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images:hugo-0:0.166.0-0.1.hum1@src"
},
"product_reference": "hugo-0:0.166.0-0.1.hum1@src",
"relates_to_product_reference": "Red Hat Hardened Images"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "hugo-0:0.166.0-0.1.hum1@x86_64 as a component of Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images:hugo-0:0.166.0-0.1.hum1@x86_64"
},
"product_reference": "hugo-0:0.166.0-0.1.hum1@x86_64",
"relates_to_product_reference": "Red Hat Hardened Images"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-10582",
"cwe": {
"id": "CWE-918",
"name": "Server-Side Request Forgery (SSRF)"
},
"discovery_date": "2026-08-24T10:41:27.631892+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2521803"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Hugo. The `security.http.urls` allowlist, which controls outbound fetches, does not adequately validate the destination address of URLs. This vulnerability allows a remote attacker to supply a specially crafted URL that resolves to internal network resources. As a result, the Hugo build process can fetch internal endpoints, and the sensitive response data may be embedded and published within the generated static site, leading to information disclosure.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "hugo: github.com/gohugoio/hugo: Hugo: Server-Side Request Forgery (SSRF) leading to information disclosure.",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:hugo-0:0.166.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:hugo-0:0.166.0-0.1.hum1@src",
"Red Hat Hardened Images:hugo-0:0.166.0-0.1.hum1@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-10582"
},
{
"category": "external",
"summary": "RHBZ#2521803",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2521803"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-10582",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-10582"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-10582",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-10582"
},
{
"category": "external",
"summary": "https://github.com/gohugoio/hugo",
"url": "https://github.com/gohugoio/hugo"
},
{
"category": "external",
"summary": "https://github.com/gohugoio/hugo/blob/v0.165.0/config/security/securityConfig.go",
"url": "https://github.com/gohugoio/hugo/blob/v0.165.0/config/security/securityConfig.go"
},
{
"category": "external",
"summary": "https://github.com/gohugoio/hugo/blob/v0.165.0/resources/resource_factories/create/create.go",
"url": "https://github.com/gohugoio/hugo/blob/v0.165.0/resources/resource_factories/create/create.go"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/hugo-through-server-side-request-forgery-via-security-http-urls-lacking-destination-address-validation",
"url": "https://www.vulncheck.com/advisories/hugo-through-server-side-request-forgery-via-security-http-urls-lacking-destination-address-validation"
}
],
"release_date": "2026-08-24T10:29:09.560000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-09T23:14:36+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:hugo-0:0.166.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:hugo-0:0.166.0-0.1.hum1@src",
"Red Hat Hardened Images:hugo-0:0.166.0-0.1.hum1@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:66266"
},
{
"category": "workaround",
"details": "To mitigate this vulnerability, ensure that the Hugo `security.http.urls` allowlist is strictly configured to permit outbound requests only to explicitly trusted external domains. Implement network egress filtering to prevent Hugo from initiating connections to internal, loopback, or private IP address ranges. This can be achieved by configuring firewall rules or network policies to block outbound traffic from the Hugo environment to RFC1918 addresses and other internal network segments.",
"product_ids": [
"Red Hat Hardened Images:hugo-0:0.166.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:hugo-0:0.166.0-0.1.hum1@src",
"Red Hat Hardened Images:hugo-0:0.166.0-0.1.hum1@x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:hugo-0:0.166.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:hugo-0:0.166.0-0.1.hum1@src",
"Red Hat Hardened Images:hugo-0:0.166.0-0.1.hum1@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "hugo: github.com/gohugoio/hugo: Hugo: Server-Side Request Forgery (SSRF) leading to information disclosure."
},
{
"cve": "CVE-2026-10618",
"cwe": {
"id": "CWE-79",
"name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
},
"discovery_date": "2026-08-24T10:41:11.282635+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2521802"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Hugo\u0027s default fenced-code-block renderer. This vulnerability allows a remote attacker to inject arbitrary script code into the rendered HTML by providing specially crafted input in the code-fence info string. Due to improper escaping of attribute values, a malicious quote can terminate an attribute and allow the injection of additional attributes, including event handlers. This can lead to client-side arbitrary code execution when a user views the affected page.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "github.com/gohugoio/hugo: Hugo: Stored Cross-Site Scripting via unescaped code-fence attribute values",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "A flaw was found in Hugo. The default fenced-code-block renderer writes attribute values from the code-fence info string into HTML without escaping them. A crafted quote character inside an attribute value terminates the attribute in the rendered HTML, allowing injection of additional attributes including event handlers. The injected script executes for every visitor who loads the page. This is exploitable under the default Hugo configuration with code fences enabled, without requiring the goldmark unsafe setting or any custom render hook. Note that attribute names beginning with \u0027on\u0027 are filtered during parsing, but injection is achieved through the attribute value rather than the name.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:hugo-0:0.166.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:hugo-0:0.166.0-0.1.hum1@src",
"Red Hat Hardened Images:hugo-0:0.166.0-0.1.hum1@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-10618"
},
{
"category": "external",
"summary": "RHBZ#2521802",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2521802"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-10618",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-10618"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-10618",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-10618"
},
{
"category": "external",
"summary": "https://github.com/gohugoio/hugo",
"url": "https://github.com/gohugoio/hugo"
},
{
"category": "external",
"summary": "https://github.com/gohugoio/hugo/blob/v0.165.0/markup/goldmark/codeblocks/render.go",
"url": "https://github.com/gohugoio/hugo/blob/v0.165.0/markup/goldmark/codeblocks/render.go"
},
{
"category": "external",
"summary": "https://github.com/gohugoio/hugo/blob/v0.165.0/markup/highlight/highlight.go",
"url": "https://github.com/gohugoio/hugo/blob/v0.165.0/markup/highlight/highlight.go"
},
{
"category": "external",
"summary": "https://github.com/gohugoio/hugo/blob/v0.165.0/markup/internal/attributes/attributes.go",
"url": "https://github.com/gohugoio/hugo/blob/v0.165.0/markup/internal/attributes/attributes.go"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/hugo-through-stored-cross-site-scripting-via-unescaped-code-fence-attribute-values",
"url": "https://www.vulncheck.com/advisories/hugo-through-stored-cross-site-scripting-via-unescaped-code-fence-attribute-values"
}
],
"release_date": "2026-08-24T10:29:10.191000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-09T23:14:36+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:hugo-0:0.166.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:hugo-0:0.166.0-0.1.hum1@src",
"Red Hat Hardened Images:hugo-0:0.166.0-0.1.hum1@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:66266"
},
{
"category": "workaround",
"details": "Update to a fixed version of Hugo. As a workaround, disable code-fence attribute support in the goldmark configuration by setting markup.highlight.codeFences to false, or use a custom render hook that explicitly escapes attribute values before writing them to HTML output.",
"product_ids": [
"Red Hat Hardened Images:hugo-0:0.166.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:hugo-0:0.166.0-0.1.hum1@src",
"Red Hat Hardened Images:hugo-0:0.166.0-0.1.hum1@x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:hugo-0:0.166.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:hugo-0:0.166.0-0.1.hum1@src",
"Red Hat Hardened Images:hugo-0:0.166.0-0.1.hum1@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "github.com/gohugoio/hugo: Hugo: Stored Cross-Site Scripting via unescaped code-fence attribute values"
},
{
"cve": "CVE-2026-33812",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-04-21T20:01:30.988800+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2460227"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in golang.org/x/image. A remote attacker could exploit this vulnerability by providing a specially crafted font file. Parsing this malicious file can lead to excessive memory allocation, which may result in a Denial of Service (DoS) for the affected system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang.org/x/image: golang.org/x/image: Denial of Service due to excessive memory allocation when parsing malicious font files",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This has been rated as Moderate impact. The golang.org/x/image package is vulnerable to a denial of service when processing a specially crafted font file. An attacker could exploit this by convincing a user to open a malicious font file, leading to excessive memory allocation and potential system unavailability. This vulnerability requires user interaction, limiting its immediate impact on typical Red Hat deployments.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:hugo-0:0.166.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:hugo-0:0.166.0-0.1.hum1@src",
"Red Hat Hardened Images:hugo-0:0.166.0-0.1.hum1@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-33812"
},
{
"category": "external",
"summary": "RHBZ#2460227",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2460227"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-33812",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-33812"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-33812",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33812"
},
{
"category": "external",
"summary": "https://go.dev/cl/761180",
"url": "https://go.dev/cl/761180"
},
{
"category": "external",
"summary": "https://go.dev/issue/78382",
"url": "https://go.dev/issue/78382"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4962",
"url": "https://pkg.go.dev/vuln/GO-2026-4962"
}
],
"release_date": "2026-04-21T19:21:28.556000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-09T23:14:36+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:hugo-0:0.166.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:hugo-0:0.166.0-0.1.hum1@src",
"Red Hat Hardened Images:hugo-0:0.166.0-0.1.hum1@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:66266"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Hardened Images:hugo-0:0.166.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:hugo-0:0.166.0-0.1.hum1@src",
"Red Hat Hardened Images:hugo-0:0.166.0-0.1.hum1@x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:hugo-0:0.166.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:hugo-0:0.166.0-0.1.hum1@src",
"Red Hat Hardened Images:hugo-0:0.166.0-0.1.hum1@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "golang.org/x/image: golang.org/x/image: Denial of Service due to excessive memory allocation when parsing malicious font files"
},
{
"cve": "CVE-2026-100690",
"cwe": {
"id": "CWE-59",
"name": "Improper Link Resolution Before File Access (\u0027Link Following\u0027)"
},
"discovery_date": "2026-09-26T13:31:52.612322+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2541815"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Hugo. This vulnerability allows information disclosure when Hugo executes build tools under the Node.js permission model, which validates only lexical file paths and fails to restrict symbolic links pointing outside the sandbox. An attacker capable of contributing content to a repository can exploit this by committing a symbolic link targeting sensitive host files alongside a build tool that reads it. Consequently, files readable by the build process can be exposed and embedded into the published site.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "github.com/gohugoio/hugo: Hugo: Arbitrary file read via symbolic link sandbox escape",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as Moderate impact because successful exploitation requires processing an untrusted project or pull request that specifically utilizes Node.js asset pipelines. Although an attacker could expose sensitive local files accessible to the builder by introducing malicious symlinks into the source tree, this flaw cannot be exploited remotely without direct user interaction or automated build triggers. Build systems and projects that only process trusted content or do not invoke Node.js asset transformations are not at risk.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:hugo-0:0.166.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:hugo-0:0.166.0-0.1.hum1@src",
"Red Hat Hardened Images:hugo-0:0.166.0-0.1.hum1@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-100690"
},
{
"category": "external",
"summary": "RHBZ#2541815",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2541815"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-100690",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-100690"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-100690",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-100690"
},
{
"category": "external",
"summary": "https://github.com/gohugoio/hugo/security/advisories/GHSA-x3mx-cm49-8m9c",
"url": "https://github.com/gohugoio/hugo/security/advisories/GHSA-x3mx-cm49-8m9c"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/hugo-0.161.0-to-0.165.0-arbitrary-file-read-via-symlinks",
"url": "https://www.vulncheck.com/advisories/hugo-0.161.0-to-0.165.0-arbitrary-file-read-via-symlinks"
}
],
"release_date": "2026-09-26T13:23:49.448000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-09T23:14:36+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:hugo-0:0.166.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:hugo-0:0.166.0-0.1.hum1@src",
"Red Hat Hardened Images:hugo-0:0.166.0-0.1.hum1@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:66266"
},
{
"category": "workaround",
"details": "To mitigate this issue, implement the following operational controls:\n\n1. Avoid processing untrusted pull requests, themes, or repository branches that execute Node.js transformation pipelines (such as PostCSS, TailwindCSS, or Babel). Builds that do not execute Node.js tools are unaffected.\n2. Isolate Hugo builds inside dedicated containers or ephemeral sandboxes that have no sensitive host directories or files mounted, and run the build process with minimal privileges.\n\nCaveat: Disabling or avoiding Node.js asset transformations may prevent custom stylesheets or scripts from compiling properly, which can alter the appearance or functionality of the generated site.",
"product_ids": [
"Red Hat Hardened Images:hugo-0:0.166.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:hugo-0:0.166.0-0.1.hum1@src",
"Red Hat Hardened Images:hugo-0:0.166.0-0.1.hum1@x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:hugo-0:0.166.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:hugo-0:0.166.0-0.1.hum1@src",
"Red Hat Hardened Images:hugo-0:0.166.0-0.1.hum1@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "github.com/gohugoio/hugo: Hugo: Arbitrary file read via symbolic link sandbox escape"
},
{
"cve": "CVE-2026-100691",
"cwe": {
"id": "CWE-79",
"name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
},
"discovery_date": "2026-09-26T13:40:38.595207+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2541895"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Hugo. The syntax highlighter fails to properly sanitize the lineAnchors option, resulting in a stored Cross-Site Scripting (XSS) vulnerability. A remote attacker capable of submitting Markdown content can exploit this by supplying a crafted lineAnchors code block attribute. When the site is generated and published, this flaw allows arbitrary script execution in the browsers of users visiting the affected pages.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "github.com/gohugoio/hugo: Hugo: Stored cross-site scripting via unescaped lineAnchors option",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as Moderate impact because successful exploitation requires an attacker to introduce malicious Markdown input into the documentation build pipeline, and any resulting script execution is confined to client browsers accessing the rendered output rather than compromising server infrastructure. In supported Red Hat environments, components embedding Hugo are typically utilized within automated pipelines or managed services where documentation and configuration sources originate from authenticated, internal repositories. Consequently, the risk of stored script injection is substantially limited unless a deployment explicitly processes unvetted content contributed by untrusted third parties.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:hugo-0:0.166.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:hugo-0:0.166.0-0.1.hum1@src",
"Red Hat Hardened Images:hugo-0:0.166.0-0.1.hum1@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-100691"
},
{
"category": "external",
"summary": "RHBZ#2541895",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2541895"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-100691",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-100691"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-100691",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-100691"
},
{
"category": "external",
"summary": "https://github.com/gohugoio/hugo/security/advisories/GHSA-q4xf-287f-98r8",
"url": "https://github.com/gohugoio/hugo/security/advisories/GHSA-q4xf-287f-98r8"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/hugo-before-0.166.0-stored-xss-via-lineanchors-code-block-option",
"url": "https://www.vulncheck.com/advisories/hugo-before-0.166.0-stored-xss-via-lineanchors-code-block-option"
}
],
"release_date": "2026-09-26T13:23:50.149000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-09T23:14:36+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:hugo-0:0.166.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:hugo-0:0.166.0-0.1.hum1@src",
"Red Hat Hardened Images:hugo-0:0.166.0-0.1.hum1@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:66266"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Hardened Images:hugo-0:0.166.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:hugo-0:0.166.0-0.1.hum1@src",
"Red Hat Hardened Images:hugo-0:0.166.0-0.1.hum1@x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:hugo-0:0.166.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:hugo-0:0.166.0-0.1.hum1@src",
"Red Hat Hardened Images:hugo-0:0.166.0-0.1.hum1@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "github.com/gohugoio/hugo: Hugo: Stored cross-site scripting via unescaped lineAnchors option"
},
{
"cve": "CVE-2026-100692",
"cwe": {
"id": "CWE-59",
"name": "Improper Link Resolution Before File Access (\u0027Link Following\u0027)"
},
"discovery_date": "2026-09-26T13:42:00.576487+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2541910"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Hugo. This vulnerability enables information disclosure when building a site that includes a crafted theme or vendored module. Because Hugo fails to properly restrict symbolic links (symlinks) at mount roots, links pointing to directories outside the project directory are traversed. Consequently, unauthorized files from the host system can be read during site generation and published into the public output directory.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "github.com/gohugoio/hugo: Hugo: Information disclosure via symlinked mount roots",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat Product Security rates this flaw Moderate. A Hugo build that incorporates an untrusted checked-in theme or vendored module with a symlinked mount root could publish local files readable by the builder. Historical Hummingbird Hugo builds used vulnerable versions; the current package contains the fix. Confirmed GitOps, OpenStack, Korrel8r, and Hummingbird Grafana affects lack the vulnerable version or build path. RHEL and rhivos Grafana remain conservatively affected but are deferred at this severity pending direct downstream build verification. Any residual risk requires running the affected Hugo site-generation path with untrusted local content.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:hugo-0:0.166.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:hugo-0:0.166.0-0.1.hum1@src",
"Red Hat Hardened Images:hugo-0:0.166.0-0.1.hum1@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-100692"
},
{
"category": "external",
"summary": "RHBZ#2541910",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2541910"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-100692",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-100692"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-100692",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-100692"
},
{
"category": "external",
"summary": "https://github.com/gohugoio/hugo/security/advisories/GHSA-797m-7j5g-3rpr",
"url": "https://github.com/gohugoio/hugo/security/advisories/GHSA-797m-7j5g-3rpr"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/hugo-before-0.166.0-path-traversal-via-symlinked-mount-roots",
"url": "https://www.vulncheck.com/advisories/hugo-before-0.166.0-path-traversal-via-symlinked-mount-roots"
}
],
"release_date": "2026-09-26T13:23:50.847000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-09T23:14:36+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:hugo-0:0.166.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:hugo-0:0.166.0-0.1.hum1@src",
"Red Hat Hardened Images:hugo-0:0.166.0-0.1.hum1@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:66266"
},
{
"category": "workaround",
"details": "Inspect checked-in themes and vendored modules for symlinks at mount roots before building. Build untrusted content in an isolated environment without access to sensitive host files.",
"product_ids": [
"Red Hat Hardened Images:hugo-0:0.166.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:hugo-0:0.166.0-0.1.hum1@src",
"Red Hat Hardened Images:hugo-0:0.166.0-0.1.hum1@x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:hugo-0:0.166.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:hugo-0:0.166.0-0.1.hum1@src",
"Red Hat Hardened Images:hugo-0:0.166.0-0.1.hum1@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "github.com/gohugoio/hugo: Hugo: Information disclosure via symlinked mount roots"
},
{
"cve": "CVE-2026-100693",
"cwe": {
"id": "CWE-918",
"name": "Server-Side Request Forgery (SSRF)"
},
"discovery_date": "2026-09-26T13:33:01.116534+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2541830"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Hugo. Case-sensitive validation in the URL deny rule mechanism allows an attacker to bypass access restrictions. By supplying mixed-case URL schemes when fetching remote resources, an attacker can access restricted network destinations, such as localhost or internal IP addresses. This may lead to unauthorized access to internal network services and information disclosure.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "github.com/gohugoio/hugo: Hugo: Security restriction bypass via mixed-case URL schemes",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat Product Security rates this flaw Moderate. In historical Hummingbird Hugo builds, an untrusted URL passed to resources.GetRemote could bypass the default IP-literal deny rule by using a mixed-case scheme, allowing the build process to fetch restricted network resources. The current Hummingbird Hugo package contains the fix. Other identified product affects are not vulnerable because their Hugo dependency versions predate the flaw or the shipped Grafana packages do not execute Hugo.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:hugo-0:0.166.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:hugo-0:0.166.0-0.1.hum1@src",
"Red Hat Hardened Images:hugo-0:0.166.0-0.1.hum1@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-100693"
},
{
"category": "external",
"summary": "RHBZ#2541830",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2541830"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-100693",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-100693"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-100693",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-100693"
},
{
"category": "external",
"summary": "https://github.com/gohugoio/hugo/security/advisories/GHSA-pmrv-x7gp-2rjw",
"url": "https://github.com/gohugoio/hugo/security/advisories/GHSA-pmrv-x7gp-2rjw"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/hugo-0.162.0-before-0.166.0-ip-literal-deny-rule-bypass",
"url": "https://www.vulncheck.com/advisories/hugo-0.162.0-before-0.166.0-ip-literal-deny-rule-bypass"
}
],
"release_date": "2026-09-26T13:23:51.556000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-09T23:14:36+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:hugo-0:0.166.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:hugo-0:0.166.0-0.1.hum1@src",
"Red Hat Hardened Images:hugo-0:0.166.0-0.1.hum1@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:66266"
},
{
"category": "workaround",
"details": "Do not pass untrusted URLs to resources.GetRemote. Where remote fetching is required, configure security.http.urls with an explicit allowlist of trusted hosts.",
"product_ids": [
"Red Hat Hardened Images:hugo-0:0.166.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:hugo-0:0.166.0-0.1.hum1@src",
"Red Hat Hardened Images:hugo-0:0.166.0-0.1.hum1@x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 4.0,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:hugo-0:0.166.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:hugo-0:0.166.0-0.1.hum1@src",
"Red Hat Hardened Images:hugo-0:0.166.0-0.1.hum1@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "github.com/gohugoio/hugo: Hugo: Security restriction bypass via mixed-case URL schemes"
},
{
"cve": "CVE-2026-100694",
"cwe": {
"id": "CWE-79",
"name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
},
"discovery_date": "2026-09-26T13:31:03.538484+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2541804"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Hugo. When processing content files mapped to the Org Mode media type, Hugo renders raw HTML export blocks and snippets without proper escaping. An attacker who can influence or supply content files can exploit this vulnerability to conduct cross-site scripting (XSS), executing malicious scripts in the web browsers of users viewing the generated site.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "github.com/gohugoio/hugo: Hugo: Cross-site scripting via unescaped HTML in Org Mode content",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as Moderate severity because successful exploitation requires an attacker to supply or influence source files declaring the Org Mode format, significantly narrowing the exposure. In Red Hat environments, Hugo and embedded components operate within static build pipelines that compile verified source repositories. The risk is limited to client browsers accessing rendered pages that incorporate unvetted Org Mode input, while deployments utilizing trusted content sources remain unaffected.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:hugo-0:0.166.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:hugo-0:0.166.0-0.1.hum1@src",
"Red Hat Hardened Images:hugo-0:0.166.0-0.1.hum1@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-100694"
},
{
"category": "external",
"summary": "RHBZ#2541804",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2541804"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-100694",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-100694"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-100694",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-100694"
},
{
"category": "external",
"summary": "https://github.com/gohugoio/hugo/security/advisories/GHSA-pq74-mj4h-cjq2",
"url": "https://github.com/gohugoio/hugo/security/advisories/GHSA-pq74-mj4h-cjq2"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/hugo-before-0.166.0-cross-site-scripting-via-text-org",
"url": "https://www.vulncheck.com/advisories/hugo-before-0.166.0-cross-site-scripting-via-text-org"
}
],
"release_date": "2026-09-26T13:23:52.256000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-09T23:14:36+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:hugo-0:0.166.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:hugo-0:0.166.0-0.1.hum1@src",
"Red Hat Hardened Images:hugo-0:0.166.0-0.1.hum1@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:66266"
},
{
"category": "workaround",
"details": "There is no mitigation available for this issue. Red Hat recommends that customers update to the latest available version that contains the fix.",
"product_ids": [
"Red Hat Hardened Images:hugo-0:0.166.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:hugo-0:0.166.0-0.1.hum1@src",
"Red Hat Hardened Images:hugo-0:0.166.0-0.1.hum1@x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:hugo-0:0.166.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:hugo-0:0.166.0-0.1.hum1@src",
"Red Hat Hardened Images:hugo-0:0.166.0-0.1.hum1@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "github.com/gohugoio/hugo: Hugo: Cross-site scripting via unescaped HTML in Org Mode content"
}
]
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.
Loading…