[Git][security-tracker-team/security-tracker][master] hugo fixed in sid

[Moritz Muehlenhoff (@jmm)]

Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / security-tracker


Commits:
d423cfce by Moritz Muehlenhoff at 2026-08-27T22:55:12+02:00
hugo fixed in sid

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -11199,7 +11199,7 @@ CVE-2026-76045 (Use after free in WebGL in Google Chrome prior to 151.0.7922.169
 	- chromium 151.0.7922.169-1
 	[bullseye] - chromium <end-of-life> (see #1061268)
 CVE-2026-75926 (Hugo 0.161.0 placed the Node asset pipelines behind the Node.js permis ...)
-	- hugo <unfixed> (bug #1144973)
+	- hugo 0.165.0-1 (bug #1144973)
 	[trixie] - hugo <not-affected> (Vulnerable code introduced later)
 	[bookworm] - hugo <not-affected> (Vulnerable code introduced later)
 	[bullseye] - hugo <not-affected> (Vulnerable code introduced later)
@@ -11207,7 +11207,6 @@ CVE-2026-75926 (Hugo 0.161.0 placed the Node asset pipelines behind the Node.js
 	NOTE: https://github.com/gohugoio/hugo/issues/15171
 	NOTE: Introduced with: https://github.com/gohugoio/hugo/commit/d65af84d1572326057a9a55e26beb0cee784698a (v0.161.1)
 	NOTE: Fixed by: https://github.com/gohugoio/hugo/commit/8a55df7af2e6da31297245cc54fa2e3b521d93e8 (v0.165.0)
-	TODO: double check introducing commit, as CVE entry claims only starting 0.162.0
 CVE-2026-75924 (A flaw was found in managed-serviceaccount. A compromised addon-manage ...)
 	NOT-FOR-US: Red Hat Multicluster Engine for Kubernetes
 CVE-2026-75915 (CodeWhale versions before 0.8.64 contain an environment variable expos ...)
@@ -56081,7 +56080,7 @@ CVE-2026-59711 (showdown contains a cross-site scripting vulnerability in metada
 CVE-2026-59710 (showdown contains a stored cross-site scripting vulnerability in the p ...)
 	NOT-FOR-US: showdown
 CVE-2026-58404 (Hugo is a static site generator. From v0.162.0 through v0.163.0, the d ...)
-	- hugo <unfixed> (bug #1141772)
+	- hugo 0.165.0-1 (bug #1141772)
 	[trixie] - hugo <not-affected> (Vulnerable code introduced later)
 	[bookworm] - hugo <not-affected> (Alt-IPv4-encoding bypass of security.http.urls added in v0.162.0)
 	[bullseye] - hugo <not-affected> (Alt-IPv4-encoding bypass of security.http.urls added in v0.162.0)
@@ -56090,7 +56089,7 @@ CVE-2026-58404 (Hugo is a static site generator. From v0.162.0 through v0.163.0,
 	NOTE: Introduced with: https://github.com/gohugoio/hugo/commit/62cef3678b219d0daf15dad040bd3df9384e5162 (v0.162.0)
 	NOTE: Fixed by: https://github.com/gohugoio/hugo/commit/a00b5c72ac57afe26df6688ece3ca544a56df372 (v0.163.1)
 CVE-2026-58403 (Hugo is a static site generator. From v0.123.0 through v0.163.0, Hugo' ...)
-	- hugo <unfixed> (bug #1141772)
+	- hugo 0.165.0-1 (bug #1141772)
 	[trixie] - hugo <no-dsa> (Minor issue)
 	[bookworm] - hugo <not-affected> (RootMappingFs.statRoot symlink regression introduced in v0.123.0)
 	[bullseye] - hugo <not-affected> (RootMappingFs.statRoot symlink regression introduced in v0.123.0)
@@ -56098,7 +56097,7 @@ CVE-2026-58403 (Hugo is a static site generator. From v0.123.0 through v0.163.0,
 	NOTE: https://github.com/gohugoio/hugo/pull/15020
 	NOTE: Fixed by: https://github.com/gohugoio/hugo/commit/cf9c8f93ca2a2838ce378f9e36d052ac2f79e229 (v0.163.1)
 CVE-2026-58402 (Hugo is a static site generator. From 0.60.0 until 0.163.3, Hugo's def ...)
-	- hugo <unfixed> (bug #1141772)
+	- hugo 0.165.0-1 (bug #1141772)
 	[trixie] - hugo <no-dsa> (Minor issue)
 	[bookworm] - hugo <postponed> (Minor issue; code-fence info-string XSS, only exploitable without control of content; mirrors trixie)
 	[bullseye] - hugo <postponed> (Minor issue; code-fence info-string XSS, only exploitable without control of content; mirrors trixie)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/d423cfce41806ddbe80ad9c5f3e723f75cad2200

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/d423cfce41806ddbe80ad9c5f3e723f75cad2200
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20260827/3bd956d4/attachment-0001.htm>