{"id":"GO-2026-5740","revision":"73bef51ffc6042a796db5acbb1b61a50","records":[{"revision":"73bef51ffc6042a796db5acbb1b61a50","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GO-2026-5740","aliases":["CVE-2026-44301","GHSA-x597-9fr4-5857"],"title":"Hugo's Node tool execution allows file system access outside the project directory in github.com/gohugoio/hugo","description":"Hugo's Node tool execution allows file system access outside the project directory in github.com/gohugoio/hugo","state":0,"publishedAt":"2026-07-24T18:35:55+00:00","modifiedAt":"2026-07-24T19:00:25.6534707+00:00","affected":[{"ecosystem":"Go","name":"github.com/gohugoio/hugo","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"0.161.0"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://github.com/gohugoio/hugo/security/advisories/GHSA-x597-9fr4-5857","https://github.com/gohugoio/hugo/commit/a54c398b93821865547a9e21c73aad8a1d7f7bc1"],"sourceUrl":"https://osv.dev/vulnerability/GO-2026-5740","license":"OSV · upstream source license applies","key":"osv:GO-2026-5740","identifiers":["GO-2026-5740","CVE-2026-44301","GHSA-x597-9fr4-5857"]},"retained":false,"historicalAffected":[]}],"coverage":[]}