Hugo CVEs recorded in NIST NVD: 9 total, 8 in the last 12 months (Source: WebPulse analysis of NIST NVD, CPE-matched (refreshed September 29, 2026))
A static website feels safe because nothing runs when a visitor arrives. The pages are built in advance. But the build itself is a place where code and files meet, and that is where the latest Hugo release spends its security effort.
What Hugo fixed
Hugo is an open-source tool that builds websites from templates and themes. Its maintainers released v0.167.0 on September 28, 2026. The release notes describe several hardening fixes. They say none are known to be exploited. They add that anyone who builds sites with untrusted themes or modules should upgrade.
Four of the fixes show the pattern. First, the Sass compiler, which turns style files into CSS, resolved some imports on its own and followed symlinks (file shortcuts). A theme could import a file from outside the project and get its content into the published CSS.
Second, the ESBuild JavaScript tool did the same for imports not found in the assets folder. Third, a symlinked directory in a theme could expose files outside the module. Fourth, explicit heading IDs went unescaped into the table of contents links, which allowed what the notes call attribute breakout.
Hugo now checks these imports against its own list of allowed read locations. The release does not say any site leaked anything.
The risk sits in the build, not the server
This shows where the trust decision lives. A theme is not a picture on a page. It is closer to a contractor given a key to your office so they can decorate. Most will stay in the rooms they were hired for. The fixes exist because a theme could reach past them.
The exit route matters too. The build output is public. In the Sass case, a file read during the build could end up in a stylesheet anyone can download. Teams that count a static site as low risk may not have asked what the build machine can read.
Read these counts with care. They are Hugo's own totals and say nothing about how it compares with other tools. The release notes give no CVE IDs for these fixes, so the counts may or may not include them. The zero KEV count fits the maintainers' statement that none of the fixes are known to be exploited.
Upgrade changes to test first
The release also changes behavior that could surprise a working site. The default baseURL is now https://example.org/ instead of empty. The maintainers say this mostly affects new and test sites. Sites that relied on the empty default for relative URLs must set it explicitly.
The root cleanDestinationDir setting is deprecated in favour of build.cleanDestinationDir.enable. Files named .git in the publish directory are now kept by default. The eq function now treats 1 and 1.0 as equal. Automatic page summaries may change for some pages.
Questions for your team
Who approves the themes and modules our sites pull in, and does anyone review them after the first install?
What files can our build machines read? Do they hold credentials that a theme should never see?
Do any of our sites depend on the empty baseURL, the old cleanup setting or the old eq behavior? Who tests these before we upgrade?
A site with no live code is not a site with no trust decisions. The decision simply moves to the build, and someone should own it.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: GitHub (gohugoio/hugo).
