Skip to content
OpenAdvisories
High RHSA-2026:66266 9 CVEs

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Published Sep 10, 2026 · Updated Oct 20, 2026

Ecosystem: Red Hat

Fixed packages 1

ReleasePackageFixed in
Red Hat · Hardened Images 1 hummingbird:1 hugo 0:0.166.0-0.1.hum1

Vulnerabilities 9

  • High 8.4
    CVE-2026-100693

    Hugo v0.162.0 before v0.166.0 IP-literal Deny Rule Bypass

    Hugo versions from v0.162.0 before v0.166.0 contain a case-sensitive validation flaw in the security.http.urls IP-literal deny rule that allows attackers to bypass restrictions. Attackers can use mixed-case URL schemes in resources.GetRemote calls to fetch fr…

    gohugoio hugo hugo hugo Debian Ubuntu
  • High 7.5
    CVE-2026-100690

    Hugo v0.161.0 to v0.165.0 Arbitrary File Read via Symlinks

    Hugo versions from v0.161.0 through v0.165.0 run Node.js tools (css.PostCSS, css.TailwindCSS, js.Babel) under the Node.js permission model to restrict file system reads to the project directory and configured mounts. Because the Node.js permission model valid…

    gohugoio hugo hugo hugo Debian Ubuntu
  • High 7.5
    CVE-2026-100692

    Hugo before v0.166.0 Path Traversal via Symlinked Mount Roots

    Hugo is a static site generator. In versions after v0.123.0 and before v0.166.0, Hugo's symlink confinement checks stopped at the mount root itself, so a theme or module checked into themes/ (or a vendored module) could contain a symlink at a mount root (for …

    gohugoio hugo hugo hugo Debian Ubuntu
  • High 7.4
    CVE-2026-10582

    Hugo 0.91.0 through 0.165.0 Server-Side Request Forgery via security.http.urls Lacking Destination Address Validation

    Hugo's security.http.urls allowlist is the only control on outbound fetches made by resources.GetRemote, and it inspects the URL text alone. CheckAllowedHTTPURL in config/security/securityConfig.go applies the configured pattern list and then re-checks a cano…

    gohugoio hugo hugo hugo Debian Ubuntu
  • Medium 6.2
    CVE-2026-44301

    Hugo: Node tool execution allows file system access outside the project directory

    Hugo is a static site generator. From 0.43 to before 0.161.0, when building a Hugo site that uses Node-based asset pipelines (PostCSS, Babel, TailwindCSS), Hugo invoked the configured Node tools without restrictions on file system access. As a result, executi…

    gohugoio hugo hugo hugo Debian Ubuntu Go
  • Medium 6.1
    CVE-2026-100694

    Hugo before 0.166.0 Cross-Site Scripting via text/org

    Hugo is a static site generator. In versions from v0.56.0 through v0.165.x, content files mapped to the text/org media type are rendered without escaping raw HTML: Org export blocks and @@html:...@@ snippets pass HTML through unescaped, resulting in cross-sit…

    gohugoio hugo hugo hugo Debian Ubuntu
  • Medium 6.1
    CVE-2026-33812

    Excessive memory allocation when decoding malicious SFNT in golang.org/x/image

    Parsing a malicious font file can cause excessive memory allocation.

    golang.org/x/image golang.org/x/image/font/sfnt mattermost-11.1 golang-golang-x-image Debian Ubuntu Wolfi Go
  • Medium 5.4
    CVE-2026-100691

    Hugo before 0.166.0 Stored XSS via lineAnchors code block option

    Hugo versions 0.75.0 through 0.165.x contain a stored cross-site scripting vulnerability: the syntax highlighter does not escape the `lineAnchors` option before passing it to Chroma, which writes the value verbatim into the `id` and `href` attributes of the g…

    gohugoio hugo hugo hugo Debian Ubuntu
  • Medium 5.4
    CVE-2026-10618

    Hugo 0.93.0 through 0.165.0 Stored Cross-Site Scripting via Unescaped Code-Fence Attribute Values

    Hugo's default fenced-code-block renderer writes attribute values taken from the code-fence info string into the rendered HTML without escaping them. New in markup/internal/attributes/attributes.go converts every attribute value from a byte slice to a string …

    gohugoio hugo hugo hugo Debian Ubuntu

References

  • article
    https://images.redhat.com/
  • report
    https://access.redhat.com/security/cve/CVE-2026-10618
  • article
    https://access.redhat.com/security/updates/classification/
  • report
    https://access.redhat.com/security/cve/CVE-2026-10582
  • report
    https://access.redhat.com/security/cve/CVE-2026-44301
  • report
    https://access.redhat.com/security/cve/CVE-2026-33812
  • report
    https://access.redhat.com/security/cve/CVE-2026-100693
  • report
    https://access.redhat.com/security/cve/CVE-2026-100690
  • report
    https://access.redhat.com/security/cve/CVE-2026-100694
  • report
    https://access.redhat.com/security/cve/CVE-2026-100692
  • report
    https://access.redhat.com/security/cve/CVE-2026-100691
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_66266.json
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2521803
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-10582
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-10582
  • article
    https://github.com/gohugoio/hugo
  • article
    https://github.com/gohugoio/hugo/blob/v0.165.0/config/security/securityConfig.go
  • article
    https://github.com/gohugoio/hugo/blob/v0.165.0/resources/resource_factories/create/create.go
  • article
    https://www.vulncheck.com/advisories/hugo-through-server-side-request-forgery-via-security-http-urls-lacking-destination-address-validation
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2521802
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-10618
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-10618
  • article
    https://github.com/gohugoio/hugo/blob/v0.165.0/markup/goldmark/codeblocks/render.go
  • article
    https://github.com/gohugoio/hugo/blob/v0.165.0/markup/highlight/highlight.go
  • article
    https://github.com/gohugoio/hugo/blob/v0.165.0/markup/internal/attributes/attributes.go
  • article
    https://www.vulncheck.com/advisories/hugo-through-stored-cross-site-scripting-via-unescaped-code-fence-attribute-values
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2460227
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-33812
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-33812
  • article
    https://go.dev/cl/761180
  • article
    https://go.dev/issue/78382
  • advisory
    https://pkg.go.dev/vuln/GO-2026-4962
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2476862
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-44301
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-44301
  • article
    https://github.com/gohugoio/hugo/security/advisories/GHSA-x597-9fr4-5857
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2541815
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-100690
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-100690