Hugo Static Site Generator Vulnerability: Critical CVE-2026-89259
EARLY WARNING · UNCONFIRMED. This page describes a developing threat that 0Day surfaced from early signals and has not yet independently confirmed. Details may change. Always verify against the primary sources before acting.
- Severity
- CRITICAL
- CVSS
- 9.8
- Affected component
- hugo (npm)
- Affected versions
- >= v0.164.0, <= v0.164.0 or >= v0.163.3, <= v0.163.3 or >= v0.163.2, <= v0.163.2 or >= v0.163.1, <= v0.163.1 or >= v0.163.0, <= v0.163.0 or >= v0.162.1, <= v0.162.1 or >= v0.162.0, <= v0.162.0 or >= v0.161.1, <= v0.161.1 or >= v0.161.0, <= v0.161.0 or >= v0.160.1, <= v0.160.1 or >= v0.160.0, <= v0.160.0 or >= v0.159.2, <= v0.159.2 or >= v0.159.1, <= v0.159.1 or >= v0.159.0, <= v0.159.0 or >= v0.158.0, <= v0.158.0 or >= v0.157.0, <= v0.157.0 or >= v0.156.0, <= v0.156.0 or >= v0.155.3, <= v0.155.3 or >= v0.155.2, <= v0.155.2 or >= v0.155.1, <= v0.155.1 or >= v0.155.0, <= v0.155.0 or >= v0.154.5, <= v0.154.5 or >= v0.154.4, <= v0.154.4 or >= v0.154.3, <= v0.154.3 or >= v0.154.2, <= v0.154.2 or >= v0.154.1, <= v0.154.1 or >= v0.154.0, <= v0.154.0 or >= v0.153.5, <= v0.153.5 or >= v0.153.4, <= v0.153.4 or >= v0.153.3, <= v0.153.3 or >= v0.153.2, <= v0.153.2 or >= v0.153.1, <= v0.153.1 or >= v0.153.0, <= v0.153.0 or >= v0.152.2, <= v0.152.2 or >= v0.152.1, <= v0.152.1 or >= v0.152.0, <= v0.152.0 or >= v0.151.1, <= v0.151.1 or >= v0.151.0, <= v0.151.0 or >= v0.150.1, <= v0.150.1 or >= v0.150.0, <= v0.150.0 or >= v0.149.1, <= v0.149.1 or >= v0.149.0, <= v0.149.0 or >= v0.148.2, <= v0.148.2 or >= v0.148.1, <= v0.148.1 or >= v0.148.0, <= v0.148.0 or >= v0.147.9, <= v0.147.9 or >= v0.147.8, <= v0.147.8 or >= v0.147.7, <= v0.147.7 or >= v0.147.6, <= v0.147.6 or >= v0.147.5, <= v0.147.5 or >= v0.147.3, <= v0.147.3 or >= v0.147.2, <= v0.147.2 or >= v0.147.1, <= v0.147.1 or >= v0.147.0, <= v0.147.0 or >= v0.146.7, <= v0.146.7 or >= v0.146.6, <= v0.146.6 or >= v0.146.5, <= v0.146.5 or >= v0.146.4, <= v0.146.4 or >= v0.146.3, <= v0.146.3 or >= v0.146.2, <= v0.146.2 or >= v0.146.1, <= v0.146.1 or >= v0.146.0, <= v0.146.0 or >= v0.145.0, <= v0.145.0 or >= v0.144.1, <= v0.144.1 or >= v0.144.0, <= v0.144.0 or >= v0.143.1, <= v0.143.1 or >= v0.143.0, <= v0.143.0 or >= v0.142.0, <= v0.142.0 or >= v0.141.0, <= v0.141.0 or >= v0.140.2, <= v0.140.2 or >= v0.140.1, <= v0.140.1 or >= v0.140.0, <= v0.140.0 or >= v0.139.4, <= v0.139.4 or >= v0.139.3, <= v0.139.3 or >= v0.139.2, <= v0.139.2 or >= v0.139.1, <= v0.139.1 or >= v0.139.0, <= v0.139.0 or >= v0.138.0, <= v0.138.0 or >= v0.137.1, <= v0.137.1 or >= v0.137.0, <= v0.137.0 or >= v0.136.5, <= v0.136.5 or >= v0.136.3, <= v0.136.3 or >= v0.136.2, <= v0.136.2 or >= v0.136.1, <= v0.136.1 or >= v0.136.0, <= v0.136.0 or >= v0.135.0, <= v0.135.0 or >= v0.134.3, <= v0.134.3 or >= v0.134.2, <= v0.134.2 or >= v0.134.1, <= v0.134.1 or >= v0.134.0, <= v0.134.0 or >= v0.133.1, <= v0.133.1 or >= v0.133.0, <= v0.133.0 or >= v0.132.2, <= v0.132.2 or >= v0.132.1, <= v0.132.1 or >= v0.132.0, <= v0.132.0 or >= v0.131.0, <= v0.131.0 or >= v0.130.0, <= v0.130.0 or >= v0.129.0, <= v0.129.0 or >= v0.128.2, <= v0.128.2 or >= v0.128.1, <= v0.128.1 or >= v0.128.0, <= v0.128.0 or >= v0.127.0, <= v0.127.0 or >= v0.126.3, <= v0.126.3 or >= v0.126.1, <= v0.126.1 or >= v0.126.0, <= v0.126.0 or >= v0.125.7, <= v0.125.7 or >= v0.125.6, <= v0.125.6 or >= v0.125.5, <= v0.125.5 or >= v0.125.4, <= v0.125.4 or >= v0.125.2, <= v0.125.2 or >= v0.125.1, <= v0.125.1 or >= v0.125.0, <= v0.125.0 or >= v0.124.1, <= v0.124.1 or >= v0.124.0, <= v0.124.0 or >= v0.123.8, <= v0.123.8 or >= v0.123.7, <= v0.123.7 or >= v0.123.6, <= v0.123.6 or >= v0.123.5, <= v0.123.5 or >= v0.123.4, <= v0.123.4 or >= v0.123.3, <= v0.123.3 or >= v0.123.2, <= v0.123.2 or >= v0.123.1, <= v0.123.1 or >= v0.122.0, <= v0.122.0 or >= v0.121.2, <= v0.121.2 or >= v0.121.1, <= v0.121.1 or >= v0.121.0, <= v0.121.0 or >= v0.120.4, <= v0.120.4 or >= v0.120.3, <= v0.120.3 or >= v0.120.2, <= v0.120.2 or >= v0.120.1, <= v0.120.1 or >= v0.120.0, <= v0.120.0 or >= v0.119.0, <= v0.119.0 or >= v0.118.2, <= v0.118.2 or >= v0.118.1, <= v0.118.1 or >= v0.118.0, <= v0.118.0 or >= v0.116.1, <= v0.116.1 or >= v0.116.0, <= v0.116.0 or >= v0.115.4, <= v0.115.4 or >= v0.115.3, <= v0.115.3 or >= v0.115.2, <= v0.115.2 or >= v0.115.1, <= v0.115.1 or >= v0.115.0, <= v0.115.0 or >= v0.114.0, <= v0.114.0 or >= v0.113.0, <= v0.113.0 or >= v0.112.7, <= v0.112.7 or >= v0.112.6, <= v0.112.6 or >= v0.112.4, <= v0.112.4 or >= v0.112.3, <= v0.112.3 or >= v0.112.2, <= v0.112.2 or >= v0.112.1, <= v0.112.1 or >= v0.112.0, <= v0.112.0 or >= v0.111.3, <= v0.111.3 or >= v0.111.2, <= v0.111.2 or >= v0.111.1, <= v0.111.1 or >= v0.110.0, <= v0.110.0 or >= v0.109.0, <= v0.109.0 or >= v0.108.0, <= v0.108.0 or >= v0.107.0, <= v0.107.0 or >= v0.106.0, <= v0.106.0 or >= v0.105.0, <= v0.105.0 or >= v0.104.3, <= v0.104.3 or >= v0.104.2, <= v0.104.2 or >= v0.104.1, <= v0.104.1 or >= v0.104.0, <= v0.104.0 or >= v0.103.1, <= v0.103.1 or >= v0.102.3, <= v0.102.3 or >= v0.102.0, <= v0.102.0 or >= v0.101.0, <= v0.101.0 or >= v0.100.2, <= v0.100.2 or >= v0.100.1, <= v0.100.1 or >= v0.100.0, <= v0.100.0 or >= v0.99.1, <= v0.99.1 or >= v0.99.0, <= v0.99.0 or >= v0.98.0, <= v0.98.0 or >= v0.97.3, <= v0.97.3 or >= v0.97.2, <= v0.97.2 or >= v0.97.1, <= v0.97.1 or >= v0.97.0, <= v0.97.0 or >= v0.95.0, <= v0.95.0 or >= v0.94.2, <= v0.94.2 or >= v0.94.1, <= v0.94.1 or >= v0.94.0, <= v0.94.0 or >= v0.93.3, <= v0.93.3 or >= v0.93.2, <= v0.93.2 or >= v0.93.1, <= v0.93.1 or >= v0.93.0, <= v0.93.0 or >= v0.92.2, <= v0.92.2 or >= v0.92.1, <= v0.92.1 or >= v0.92.0, <= v0.92.0 or >= v0.91.2, <= v0.91.2 or >= v0.91.1, <= v0.91.1 or >= v0.91.0, <= v0.91.0 or >= v0.90.1, <= v0.90.1 or >= v0.90.0, <= v0.90.0 or >= v0.89.4, <= v0.89.4 or >= v0.89.3, <= v0.89.3 or >= v0.89.2, <= v0.89.2 or >= v0.89.1, <= v0.89.1 or >= v0.89.0, <= v0.89.0 or >= v0.88.1, <= v0.88.1 or >= v0.88.0, <= v0.88.0 or >= v0.87.0, <= v0.87.0 or >= v0.86.0, <= v0.86.0 or >= v0.85.0, <= v0.85.0 or >= v0.84.4, <= v0.84.4 or >= v0.84.3, <= v0.84.3 or >= v0.84.2, <= v0.84.2 or >= v0.84.1, <= v0.84.1 or >= v0.84.0, <= v0.84.0 or >= v0.83.1, <= v0.83.1 or >= v0.83.0, <= v0.83.0 or >= v0.82.0, <= v0.82.0 or >= v0.81.0, <= v0.81.0 or >= v0.80.0, <= v0.80.0 or >= v0.79.0, <= v0.79.0 or >= v0.78.2, <= v0.78.2 or >= v0.78.1, <= v0.78.1 or >= v0.78.0, <= v0.78.0 or >= v0.77.0, <= v0.77.0 or >= v0.76.4, <= v0.76.4 or >= v0.76.2, <= v0.76.2 or >= v0.76.1, <= v0.76.1 or >= v0.76.0, <= v0.76.0 or >= v0.75.1, <= v0.75.1 or >= v0.75.0, <= v0.75.0 or >= v0.74.3, <= v0.74.3 or >= v0.74.2, <= v0.74.2 or >= v0.74.1, <= v0.74.1 or >= v0.74.0, <= v0.74.0 or >= v0.72.0, <= v0.72.0 or >= v0.71.1, <= v0.71.1 or >= v0.71.0, <= v0.71.0 or >= v0.70.0, <= v0.70.0 or >= v0.69.2, <= v0.69.2 or >= v0.69.1, <= v0.69.1 or >= v0.69.0, <= v0.69.0 or >= v0.68.3, <= v0.68.3 or >= v0.68.2, <= v0.68.2 or >= v0.68.1, <= v0.68.1 or >= v0.68.0, <= v0.68.0 or >= v0.67.1, <= v0.67.1 or >= v0.67.0, <= v0.67.0 or >= v0.66.0, <= v0.66.0 or >= v0.65.3, <= v0.65.3 or >= v0.65.2, <= v0.65.2 or >= v0.65.1, <= v0.65.1 or >= v0.65.0, <= v0.65.0 or >= v0.64.1, <= v0.64.1 or >= v0.64.0, <= v0.64.0 or >= v0.63.2, <= v0.63.2 or >= v0.63.1, <= v0.63.1 or >= v0.63.0, <= v0.63.0 or >= v0.62.2, <= v0.62.2 or >= v0.62.1, <= v0.62.1 or >= v0.62.0, <= v0.62.0 or >= v0.61.0, <= v0.61.0 or >= v0.60.1, <= v0.60.1 or >= v0.60.0, <= v0.60.0 or >= v0.59.1, <= v0.59.1 or >= v0.59.0, <= v0.59.0 or >= v0.58.3, <= v0.58.3 or >= v0.58.2, <= v0.58.2 or >= v0.58.1, <= v0.58.1 or >= v0.58.0, <= v0.58.0 or >= v0.57.2, <= v0.57.2 or >= v0.57.1, <= v0.57.1 or >= v0.57.0, <= v0.57.0 or >= v0.56.3, <= v0.56.3 or >= v0.56.2, <= v0.56.2 or >= v0.56.0, <= v0.56.0 or >= v0.55.5, <= v0.55.5 or >= v0.55.4, <= v0.55.4 or >= v0.55.3, <= v0.55.3 or >= v0.55.2, <= v0.55.2 or >= v0.55.1, <= v0.55.1 or >= v0.55.0, <= v0.55.0 or >= v0.54.0, <= v0.54.0 or >= v0.53, <= v0.53 or >= v0.52, <= v0.52 or >= v0.51, <= v0.51 or >= v0.50, <= v0.50 or >= v0.49, <= v0.49 or >= v0.48, <= v0.48 or >= v0.47.1, <= v0.47.1 or >= v0.47, <= v0.47 or >= v0.46, <= v0.46 or >= v0.45.1, <= v0.45.1 or >= v0.45, <= v0.45 or >= v0.44, <= v0.44 or >= v0.43, <= v0.43 or >= v0.42.1, <= v0.42.1 or >= v0.40.2, <= v0.40.2 or >= v0.40.1, <= v0.40.1 or >= v0.40, <= v0.40 or >= v0.39, <= v0.39 or >= v0.38.2, <= v0.38.2 or >= v0.38.1, <= v0.38.1 or >= v0.38, <= v0.38 or >= v0.37.1, <= v0.37.1 or >= v0.37, <= v0.37 or >= v0.36, <= v0.36 or >= v0.35, <= v0.35 or >= v0.34, <= v0.34 or >= v0.33, <= v0.33 or >= v0.32.4, <= v0.32.4 or >= v0.32.3, <= v0.32.3 or >= v0.32.2, <= v0.32.2 or >= v0.32.1, <= v0.32.1 or >= v0.32, <= v0.32 or >= v0.31.1, <= v0.31.1 or >= v0.31, <= v0.31 or >= v0.30.2, <= v0.30.2 or >= v0.30.1, <= v0.30.1 or >= v0.30, <= v0.30 or >= v0.29, <= v0.29 or >= v0.28, <= v0.28 or >= v0.27.1, <= v0.27.1 or >= v0.27, <= v0.27 or >= v0.26, <= v0.26 or >= v0.25.1, <= v0.25.1 or >= v0.25, <= v0.25 or >= v0.24, <= v0.24 or >= v0.23, <= v0.23 or >= v0.22.1, <= v0.22.1 or >= v0.22, <= v0.22 or >= v0.21, <= v0.21 or >= v0.20.4, <= v0.20.4 or >= v0.20.1, <= v0.20.1 or >= v0.20, <= v0.20 or >= v0.19, <= v0.19 or >= v0.18, <= v0.18 or >= v0.17, <= v0.17 or >= v0.16, <= v0.16 or >= v0.15, <= v0.15 or >= v0.14, <= v0.14 or >= v0.13, <= v0.13 or >= v0.12, <= v0.12 or >= v0.11, <= v0.11 or >= v0.10, <= v0.10 or >= v0.9, <= v0.9 or >= v0.7, <= v0.7
- Patched version
- 0.165.0
CVE-2026-89259GHSA-X597-9FR4-5857
Hugo, a static site generator, has a critical vulnerability allowing Node tools to read and write files outside the project's working directory. This affects versions after v0.43.
What happened
A critical vulnerability has been reported in Hugo, a static site generator. The vulnerability, tracked as CVE-2026-89259, allows Node tools to read and write files outside the project's working directory. This can potentially lead to unauthorized access to sensitive data or system compromise. The vulnerability affects versions of Hugo after v0.43. The issue was first flagged on 2026-09-11.
The vulnerability has a CVSS score of 9.8, indicating a critical severity level. It has not been reported as exploited in the wild. The affected versions include a wide range from v0.43 to v0.164.0. The vulnerability was fixed in version 0.165.0.
What to do about it
- Upgrade Hugo to version 0.165.0 or later to mitigate the risk.
- Review your project's dependencies and ensure that Hugo is updated to the latest secure version.
- Monitor the primary sources for any updates or additional information related to this vulnerability.
How 0Day would have caught this
MATCHED TO YOUR ACTUAL DEPENDENCY GRAPH0Day matches every incoming threat signal against your GitHub organization’s full dependency graph, including transitive dependencies. If
hugo is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
You are affected if you are using Hugo versions after v0.43 and before v0.165.0.
What should I do right now?
Upgrade Hugo to version 0.165.0 or later to mitigate the risk.
Has this been exploited in the wild?
No, this vulnerability has not been reported as exploited in the wild.