GO-2024-2747: Hugo Markdown titles are not escaped in internal render hooks in github.com/gohugoio/hugo
GO-2024-3314: Hugo does not escape some attributes in internal templates in github.com/gohugoio/hugo
GO-2026-5309: Hugo: Symlink confinement bypass in os.ReadFile in github.com/gohugoio/hugo
GO-2026-5313: Hugo: XSS via text/html content files in github.com/gohugoio/hugo
GO-2026-5380: Hugo: Symlink confinement bypass in resources.Get in github.com/gohugoio/hugo
GO-2026-5504: Hugo: Certain markdown links are not properly escaped in github.com/gohugoio/hugo
GO-2026-5569: Hugo: XSS via unescaped code-fence language in default code block renderer in github.com/gohugoio/hugo
GO-2026-5681: Hugo: security.http.urls allow-list bypass via HTTP redirects in github.com/gohugoio/hugo
GO-2026-5740: Hugo's Node tool execution allows file system access outside the project directory in github.com/gohugoio/hugo