Skip to content
Vulnerability intelligence

CVE-2026-94448: Go's html/template package not reset on consecutive expressions

The security content of this release comes mostly from upgrades to the tools Hugo is built on. One change limits what a theme can do.

Hugo 2026