{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for Red Hat Hardened Images RPMs is now available.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "This update includes the following RPMs:\n\nhugo:\n  * hugo-0.166.0-0.1.hum1 (aarch64, x86_64)\n  * hugo-0.166.0-0.1.hum1.src (src)",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:66266",
        "url": "https://access.redhat.com/errata/RHSA-2026:66266"
      },
      {
        "category": "external",
        "summary": "https://images.redhat.com/",
        "url": "https://images.redhat.com/"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-10618",
        "url": "https://access.redhat.com/security/cve/CVE-2026-10618"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/",
        "url": "https://access.redhat.com/security/updates/classification/"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-10582",
        "url": "https://access.redhat.com/security/cve/CVE-2026-10582"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-44301",
        "url": "https://access.redhat.com/security/cve/CVE-2026-44301"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-33812",
        "url": "https://access.redhat.com/security/cve/CVE-2026-33812"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-100693",
        "url": "https://access.redhat.com/security/cve/CVE-2026-100693"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-100690",
        "url": "https://access.redhat.com/security/cve/CVE-2026-100690"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-100694",
        "url": "https://access.redhat.com/security/cve/CVE-2026-100694"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-100692",
        "url": "https://access.redhat.com/security/cve/CVE-2026-100692"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-100691",
        "url": "https://access.redhat.com/security/cve/CVE-2026-100691"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_66266.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update",
    "tracking": {
      "current_release_date": "2026-11-07T05:54:12+00:00",
      "generator": {
        "date": "2026-11-07T05:54:12+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.4.5"
        }
      },
      "id": "RHSA-2026:66266",
      "initial_release_date": "2026-09-09T23:14:36+00:00",
      "revision_history": [
        {
          "date": "2026-09-09T23:14:36+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-09-26T15:12:47+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-11-07T05:54:12+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Hardened Images",
                "product": {
                  "name": "Red Hat Hardened Images",
                  "product_id": "Red Hat Hardened Images",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:hummingbird:1"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Hardened Images"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "hugo-0:0.166.0-0.1.hum1@aarch64",
                "product": {
                  "name": "hugo-0:0.166.0-0.1.hum1@aarch64",
                  "product_id": "hugo-0:0.166.0-0.1.hum1@aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/hugo@0.166.0-0.1.hum1?arch=aarch64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "hugo-0:0.166.0-0.1.hum1@src",
                "product": {
                  "name": "hugo-0:0.166.0-0.1.hum1@src",
                  "product_id": "hugo-0:0.166.0-0.1.hum1@src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/hugo@0.166.0-0.1.hum1?arch=src\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-source-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "hugo-0:0.166.0-0.1.hum1@x86_64",
                "product": {
                  "name": "hugo-0:0.166.0-0.1.hum1@x86_64",
                  "product_id": "hugo-0:0.166.0-0.1.hum1@x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/hugo@0.166.0-0.1.hum1?arch=x86_64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "hugo-0:0.166.0-0.1.hum1@aarch64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:hugo-0:0.166.0-0.1.hum1@aarch64"
        },
        "product_reference": "hugo-0:0.166.0-0.1.hum1@aarch64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "hugo-0:0.166.0-0.1.hum1@src as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:hugo-0:0.166.0-0.1.hum1@src"
        },
        "product_reference": "hugo-0:0.166.0-0.1.hum1@src",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "hugo-0:0.166.0-0.1.hum1@x86_64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:hugo-0:0.166.0-0.1.hum1@x86_64"
        },
        "product_reference": "hugo-0:0.166.0-0.1.hum1@x86_64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-10582",
      "cwe": {
        "id": "CWE-918",
        "name": "Server-Side Request Forgery"
      },
      "discovery_date": "2026-08-24T10:41:27.631892+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2521803"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Hugo. The `security.http.urls` allowlist, which controls outbound fetches, does not adequately validate the destination address of URLs. This vulnerability allows a remote attacker to supply a specially crafted URL that resolves to internal network resources. As a result, the Hugo build process can fetch internal endpoints, and the sensitive response data may be embedded and published within the generated static site, leading to information disclosure.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "hugo: github.com/gohugoio/hugo: Hugo: Server-Side Request Forgery (SSRF) leading to information disclosure.",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated as Important severity because an attacker who can inject content into the site generation pipeline can force the build environment to query sensitive internal services and leak confidential responses into publicly distributed build artifacts. In typical Red Hat environments, Hugo is used within automated CI/CD pipelines and containerized documentation workflows where build workers often operate inside protected internal networks or cloud environments with access to metadata services. Exploitation requires the ability to supply or modify content fields that trigger remote resource fetching, meaning environments that build only fully trusted, internally vetted repositories have significantly lower exposure.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:hugo-0:0.166.0-0.1.hum1@aarch64",
          "Red Hat Hardened Images:hugo-0:0.166.0-0.1.hum1@src",
          "Red Hat Hardened Images:hugo-0:0.166.0-0.1.hum1@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-10582"
        },
        {
          "category": "external",
          "summary": "RHBZ#2521803",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2521803"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-10582",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-10582"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-10582",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-10582"
        },
        {
          "category": "external",
          "summary": "https://github.com/gohugoio/hugo",
          "url": "https://github.com/gohugoio/hugo"
        },
        {
          "category": "external",
          "summary": "https://github.com/gohugoio/hugo/blob/v0.165.0/config/security/securityConfig.go",
          "url": "https://github.com/gohugoio/hugo/blob/v0.165.0/config/security/securityConfig.go"
        },
        {
          "category": "external",
          "summary": "https://github.com/gohugoio/hugo/blob/v0.165.0/resources/resource_factories/create/create.go",
          "url": "https://github.com/gohugoio/hugo/blob/v0.165.0/resources/resource_factories/create/create.go"
        },
        {
          "category": "external",
          "summary": "https://www.vulncheck.com/advisories/hugo-through-server-side-request-forgery-via-security-http-urls-lacking-destination-address-validation",
          "url": "https://www.vulncheck.com/advisories/hugo-through-server-side-request-forgery-via-security-http-urls-lacking-destination-address-validation"
        }
      ],
      "release_date": "2026-08-24T10:29:09.560000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-09T23:14:36+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:hugo-0:0.166.0-0.1.hum1@aarch64",
            "Red Hat Hardened Images:hugo-0:0.166.0-0.1.hum1@src",
            "Red Hat Hardened Images:hugo-0:0.166.0-0.1.hum1@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:66266"
        },
        {
          "category": "workaround",
          "details": "To mitigate this vulnerability, ensure that the Hugo `security.http.urls` allowlist is strictly configured to permit outbound requests only to explicitly trusted external domains. Implement network egress filtering to prevent Hugo from initiating connections to internal, loopback, or private IP address ranges. This can be achieved by configuring firewall rules or network policies to block outbound traffic from the Hugo environment to RFC1918 addresses and other internal network segments.",
          "product_ids": [
            "Red Hat Hardened Images:hugo-0:0.166.0-0.1.hum1@aarch64",
            "Red Hat Hardened Images:hugo-0:0.166.0-0.1.hum1@src",
            "Red Hat Hardened Images:hugo-0:0.166.0-0.1.hum1@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:hugo-0:0.166.0-0.1.hum1@aarch64",
            "Red Hat Hardened Images:hugo-0:0.166.0-0.1.hum1@src",
            "Red Hat Hardened Images:hugo-0:0.166.0-0.1.hum1@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "hugo: github.com/gohugoio/hugo: Hugo: Server-Side Request Forgery (SSRF) leading to information disclosure."
    },
    {
      "cve": "CVE-2026-10618",
      "cwe": {
        "id": "CWE-79",
        "name": "Improper Neutralization of Input During Web Page Generation"
      },
      "discovery_date": "2026-08-24T10:41:11.282635+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2521802"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Hugo\u0027s default fenced-code-block renderer. This vulnerability allows a remote attacker to inject arbitrary script code into the rendered HTML by providing specially crafted input in the code-fence info string. Due to improper escaping of attribute values, a malicious quote can terminate an attribute and allow the injection of additional attributes, including event handlers. This can lead to client-side arbitrary code execution when a user views the affected page.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "github.com/gohugoio/hugo: Hugo: Stored Cross-Site Scripting via unescaped code-fence attribute values",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "A flaw was found in Hugo. The default fenced-code-block renderer writes attribute values from the code-fence info string into HTML without escaping them. A crafted quote character inside an attribute value terminates the attribute in the rendered HTML, allowing injection of additional attributes including event handlers. The injected script executes for every visitor who loads the page. This is exploitable under the default Hugo configuration with code fences enabled, without requiring the goldmark unsafe setting or any custom render hook. Note that attribute names beginning with \u0027on\u0027 are filtered during parsing, but injection is achieved through the attribute value rather than the name.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:hugo-0:0.166.0-0.1.hum1@aarch64",
          "Red Hat Hardened Images:hugo-0:0.166.0-0.1.hum1@src",
          "Red Hat Hardened Images:hugo-0:0.166.0-0.1.hum1@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-10618"
        },
        {
          "category": "external",
          "summary": "RHBZ#2521802",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2521802"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-10618",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-10618"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-10618",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-10618"
        },
        {
          "category": "external",
          "summary": "https://github.com/gohugoio/hugo",
          "url": "https://github.com/gohugoio/hugo"
        },
        {
          "category": "external",
          "summary": "https://github.com/gohugoio/hugo/blob/v0.165.0/markup/goldmark/codeblocks/render.go",
          "url": "https://github.com/gohugoio/hugo/blob/v0.165.0/markup/goldmark/codeblocks/render.go"
        },
        {
          "category": "external",
          "summary": "https://github.com/gohugoio/hugo/blob/v0.165.0/markup/highlight/highlight.go",
          "url": "https://github.com/gohugoio/hugo/blob/v0.165.0/markup/highlight/highlight.go"
        },
        {
          "category": "external",
          "summary": "https://github.com/gohugoio/hugo/blob/v0.165.0/markup/internal/attributes/attributes.go",
          "url": "https://github.com/gohugoio/hugo/blob/v0.165.0/markup/internal/attributes/attributes.go"
        },
        {
          "category": "external",
          "summary": "https://www.vulncheck.com/advisories/hugo-through-stored-cross-site-scripting-via-unescaped-code-fence-attribute-values",
          "url": "https://www.vulncheck.com/advisories/hugo-through-stored-cross-site-scripting-via-unescaped-code-fence-attribute-values"
        }
      ],
      "release_date": "2026-08-24T10:29:10.191000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-09T23:14:36+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:hugo-0:0.166.0-0.1.hum1@aarch64",
            "Red Hat Hardened Images:hugo-0:0.166.0-0.1.hum1@src",
            "Red Hat Hardened Images:hugo-0:0.166.0-0.1.hum1@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:66266"
        },
        {
          "category": "workaround",
          "details": "Update to a fixed version of Hugo. As a workaround, disable code-fence attribute support in the goldmark configuration by setting markup.highlight.codeFences to false, or use a custom render hook that explicitly escapes attribute values before writing them to HTML output.",
          "product_ids": [
            "Red Hat Hardened Images:hugo-0:0.166.0-0.1.hum1@aarch64",
            "Red Hat Hardened Images:hugo-0:0.166.0-0.1.hum1@src",
            "Red Hat Hardened Images:hugo-0:0.166.0-0.1.hum1@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:hugo-0:0.166.0-0.1.hum1@aarch64",
            "Red Hat Hardened Images:hugo-0:0.166.0-0.1.hum1@src",
            "Red Hat Hardened Images:hugo-0:0.166.0-0.1.hum1@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "github.com/gohugoio/hugo: Hugo: Stored Cross-Site Scripting via unescaped code-fence attribute values"
    },
    {
      "cve": "CVE-2026-33812",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-04-21T20:01:30.988800+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2460227"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in golang.org/x/image. A remote attacker could exploit this vulnerability by providing a specially crafted font file. Parsing this malicious file can lead to excessive memory allocation, which may result in a Denial of Service (DoS) for the affected system.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "golang.org/x/image: golang.org/x/image: Denial of Service due to excessive memory allocation when parsing malicious font files",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This has been rated as Moderate impact. The golang.org/x/image package is vulnerable to a denial of service when processing a specially crafted font file. An attacker could exploit this by convincing a user to open a malicious font file, leading to excessive memory allocation and potential system unavailability. This vulnerability requires user interaction, limiting its immediate impact on typical Red Hat deployments.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:hugo-0:0.166.0-0.1.hum1@aarch64",
          "Red Hat Hardened Images:hugo-0:0.166.0-0.1.hum1@src",
          "Red Hat Hardened Images:hugo-0:0.166.0-0.1.hum1@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-33812"
        },
        {
          "category": "external",
          "summary": "RHBZ#2460227",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2460227"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-33812",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-33812"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-33812",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33812"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/761180",
          "url": "https://go.dev/cl/761180"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/78382",
          "url": "https://go.dev/issue/78382"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-4962",
          "url": "https://pkg.go.dev/vuln/GO-2026-4962"
        }
      ],
      "release_date": "2026-04-21T19:21:28.556000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-09T23:14:36+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:hugo-0:0.166.0-0.1.hum1@aarch64",
            "Red Hat Hardened Images:hugo-0:0.166.0-0.1.hum1@src",
            "Red Hat Hardened Images:hugo-0:0.166.0-0.1.hum1@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:66266"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat Hardened Images:hugo-0:0.166.0-0.1.hum1@aarch64",
            "Red Hat Hardened Images:hugo-0:0.166.0-0.1.hum1@src",
            "Red Hat Hardened Images:hugo-0:0.166.0-0.1.hum1@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:hugo-0:0.166.0-0.1.hum1@aarch64",
            "Red Hat Hardened Images:hugo-0:0.166.0-0.1.hum1@src",
            "Red Hat Hardened Images:hugo-0:0.166.0-0.1.hum1@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "golang.org/x/image: golang.org/x/image: Denial of Service due to excessive memory allocation when parsing malicious font files"
    },
    {
      "cve": "CVE-2026-44301",
      "cwe": {
        "id": "CWE-22",
        "name": "Improper Limitation of a Pathname to a Restricted Directory"
      },
      "discovery_date": "2026-05-12T22:01:53.280762+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2476862"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Hugo. When building a Hugo site that uses Node-based asset pipelines (such as PostCSS, Babel, or TailwindCSS), Hugo invoked the configured Node tools without restrictions on file system access. This could allow code running through these tools to read or write files outside the project\u0027s working directory when executing Hugo against an untrusted site.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "hugo: Hugo: Arbitrary file read/write via unrestricted file system access in Node-based asset pipelines",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "A flaw was found in Hugo when building sites configured with Node-based asset pipelines such as PostCSS, Babel, or TailwindCSS. Hugo invokes these external tools without enforcing directory confinement or file system access restrictions. By tricking a user or automated build pipeline into compiling an untrusted repository containing malicious pipeline configurations, an attacker can read or write arbitrary files outside the project root directory within the context of the user running Hugo.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:hugo-0:0.166.0-0.1.hum1@aarch64",
          "Red Hat Hardened Images:hugo-0:0.166.0-0.1.hum1@src",
          "Red Hat Hardened Images:hugo-0:0.166.0-0.1.hum1@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-44301"
        },
        {
          "category": "external",
          "summary": "RHBZ#2476862",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2476862"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-44301",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-44301"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-44301",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44301"
        },
        {
          "category": "external",
          "summary": "https://github.com/gohugoio/hugo/security/advisories/GHSA-x597-9fr4-5857",
          "url": "https://github.com/gohugoio/hugo/security/advisories/GHSA-x597-9fr4-5857"
        }
      ],
      "release_date": "2026-05-12T21:37:52.825000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-09T23:14:36+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:hugo-0:0.166.0-0.1.hum1@aarch64",
            "Red Hat Hardened Images:hugo-0:0.166.0-0.1.hum1@src",
            "Red Hat Hardened Images:hugo-0:0.166.0-0.1.hum1@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:66266"
        },
        {
          "category": "workaround",
          "details": "Avoid building untrusted Hugo sites, or disable Node-based asset pipelines such as PostCSS, Babel, and TailwindCSS in site configurations. When processing unverified repositories, execute Hugo builds within an isolated, unprivileged container environment.",
          "product_ids": [
            "Red Hat Hardened Images:hugo-0:0.166.0-0.1.hum1@aarch64",
            "Red Hat Hardened Images:hugo-0:0.166.0-0.1.hum1@src",
            "Red Hat Hardened Images:hugo-0:0.166.0-0.1.hum1@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:hugo-0:0.166.0-0.1.hum1@aarch64",
            "Red Hat Hardened Images:hugo-0:0.166.0-0.1.hum1@src",
            "Red Hat Hardened Images:hugo-0:0.166.0-0.1.hum1@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "hugo: Hugo: Arbitrary file read/write via unrestricted file system access in Node-based asset pipelines"
    },
    {
      "cve": "CVE-2026-100690",
      "cwe": {
        "id": "CWE-59",
        "name": "Improper Link Resolution Before File Access"
      },
      "discovery_date": "2026-09-26T13:31:52.612322+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2541815"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Hugo. This vulnerability allows information disclosure when Hugo executes build tools under the Node.js permission model, which validates only lexical file paths and fails to restrict symbolic links pointing outside the sandbox. An attacker capable of contributing content to a repository can exploit this by committing a symbolic link targeting sensitive host files alongside a build tool that reads it. Consequently, files readable by the build process can be exposed and embedded into the published site.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "github.com/gohugoio/hugo: Hugo: Arbitrary file read via symbolic link sandbox escape",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated as Moderate impact because successful exploitation requires processing an untrusted project or pull request that specifically utilizes Node.js asset pipelines. Although an attacker could expose sensitive local files accessible to the builder by introducing malicious symlinks into the source tree, this flaw cannot be exploited remotely without direct user interaction or automated build triggers. Build systems and projects that only process trusted content or do not invoke Node.js asset transformations are not at risk.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:hugo-0:0.166.0-0.1.hum1@aarch64",
          "Red Hat Hardened Images:hugo-0:0.166.0-0.1.hum1@src",
          "Red Hat Hardened Images:hugo-0:0.166.0-0.1.hum1@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-100690"
        },
        {
          "category": "external",
          "summary": "RHBZ#2541815",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2541815"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-100690",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-100690"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-100690",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-100690"
        },
        {
          "category": "external",
          "summary": "https://github.com/gohugoio/hugo/security/advisories/GHSA-x3mx-cm49-8m9c",
          "url": "https://github.com/gohugoio/hugo/security/advisories/GHSA-x3mx-cm49-8m9c"
        },
        {
          "category": "external",
          "summary": "https://www.vulncheck.com/advisories/hugo-0.161.0-to-0.165.0-arbitrary-file-read-via-symlinks",
          "url": "https://www.vulncheck.com/advisories/hugo-0.161.0-to-0.165.0-arbitrary-file-read-via-symlinks"
        }
      ],
      "release_date": "2026-09-26T13:23:49.448000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-09T23:14:36+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:hugo-0:0.166.0-0.1.hum1@aarch64",
            "Red Hat Hardened Images:hugo-0:0.166.0-0.1.hum1@src",
            "Red Hat Hardened Images:hugo-0:0.166.0-0.1.hum1@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:66266"
        },
        {
          "category": "workaround",
          "details": "To mitigate this issue, implement the following operational controls:\n\n1. Avoid processing untrusted pull requests, themes, or repository branches that execute Node.js transformation pipelines (such as PostCSS, TailwindCSS, or Babel). Builds that do not execute Node.js tools are unaffected.\n2. Isolate Hugo builds inside dedicated containers or ephemeral sandboxes that have no sensitive host directories or files mounted, and run the build process with minimal privileges.\n\nCaveat: Disabling or avoiding Node.js asset transformations may prevent custom stylesheets or scripts from compiling properly, which can alter the appearance or functionality of the generated site.",
          "product_ids": [
            "Red Hat Hardened Images:hugo-0:0.166.0-0.1.hum1@aarch64",
            "Red Hat Hardened Images:hugo-0:0.166.0-0.1.hum1@src",
            "Red Hat Hardened Images:hugo-0:0.166.0-0.1.hum1@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:hugo-0:0.166.0-0.1.hum1@aarch64",
            "Red Hat Hardened Images:hugo-0:0.166.0-0.1.hum1@src",
            "Red Hat Hardened Images:hugo-0:0.166.0-0.1.hum1@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "github.com/gohugoio/hugo: Hugo: Arbitrary file read via symbolic link sandbox escape"
    },
    {
      "cve": "CVE-2026-100691",
      "cwe": {
        "id": "CWE-79",
        "name": "Improper Neutralization of Input During Web Page Generation"
      },
      "discovery_date": "2026-09-26T13:40:38.595207+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2541895"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Hugo. The syntax highlighter fails to properly sanitize the lineAnchors option, resulting in a stored Cross-Site Scripting (XSS) vulnerability. A remote attacker capable of submitting Markdown content can exploit this by supplying a crafted lineAnchors code block attribute. When the site is generated and published, this flaw allows arbitrary script execution in the browsers of users visiting the affected pages.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "github.com/gohugoio/hugo: Hugo: Stored cross-site scripting via unescaped lineAnchors option",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated as Moderate impact because successful exploitation requires an attacker to introduce malicious Markdown input into the documentation build pipeline, and any resulting script execution is confined to client browsers accessing the rendered output rather than compromising server infrastructure. In supported Red Hat environments, components embedding Hugo are typically utilized within automated pipelines or managed services where documentation and configuration sources originate from authenticated, internal repositories. Consequently, the risk of stored script injection is substantially limited unless a deployment explicitly processes unvetted content contributed by untrusted third parties.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:hugo-0:0.166.0-0.1.hum1@aarch64",
          "Red Hat Hardened Images:hugo-0:0.166.0-0.1.hum1@src",
          "Red Hat Hardened Images:hugo-0:0.166.0-0.1.hum1@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-100691"
        },
        {
          "category": "external",
          "summary": "RHBZ#2541895",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2541895"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-100691",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-100691"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-100691",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-100691"
        },
        {
          "category": "external",
          "summary": "https://github.com/gohugoio/hugo/security/advisories/GHSA-q4xf-287f-98r8",
          "url": "https://github.com/gohugoio/hugo/security/advisories/GHSA-q4xf-287f-98r8"
        },
        {
          "category": "external",
          "summary": "https://www.vulncheck.com/advisories/hugo-before-0.166.0-stored-xss-via-lineanchors-code-block-option",
          "url": "https://www.vulncheck.com/advisories/hugo-before-0.166.0-stored-xss-via-lineanchors-code-block-option"
        }
      ],
      "release_date": "2026-09-26T13:23:50.149000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-09T23:14:36+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:hugo-0:0.166.0-0.1.hum1@aarch64",
            "Red Hat Hardened Images:hugo-0:0.166.0-0.1.hum1@src",
            "Red Hat Hardened Images:hugo-0:0.166.0-0.1.hum1@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:66266"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat Hardened Images:hugo-0:0.166.0-0.1.hum1@aarch64",
            "Red Hat Hardened Images:hugo-0:0.166.0-0.1.hum1@src",
            "Red Hat Hardened Images:hugo-0:0.166.0-0.1.hum1@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:hugo-0:0.166.0-0.1.hum1@aarch64",
            "Red Hat Hardened Images:hugo-0:0.166.0-0.1.hum1@src",
            "Red Hat Hardened Images:hugo-0:0.166.0-0.1.hum1@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "github.com/gohugoio/hugo: Hugo: Stored cross-site scripting via unescaped lineAnchors option"
    },
    {
      "cve": "CVE-2026-100692",
      "cwe": {
        "id": "CWE-59",
        "name": "Improper Link Resolution Before File Access"
      },
      "discovery_date": "2026-09-26T13:42:00.576487+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2541910"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Hugo. This vulnerability enables information disclosure when building a site that includes a crafted theme or vendored module. Because Hugo fails to properly restrict symbolic links (symlinks) at mount roots, links pointing to directories outside the project directory are traversed. Consequently, unauthorized files from the host system can be read during site generation and published into the public output directory.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "github.com/gohugoio/hugo: Hugo: Information disclosure via symlinked mount roots",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates this flaw Moderate. A Hugo build that incorporates an untrusted checked-in theme or vendored module with a symlinked mount root could publish local files readable by the builder. Historical Hummingbird Hugo builds used vulnerable versions; the current package contains the fix. Confirmed GitOps, OpenStack, Korrel8r, and Hummingbird Grafana affects lack the vulnerable version or build path. RHEL and rhivos Grafana remain conservatively affected but are deferred at this severity pending direct downstream build verification. Any residual risk requires running the affected Hugo site-generation path with untrusted local content.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:hugo-0:0.166.0-0.1.hum1@aarch64",
          "Red Hat Hardened Images:hugo-0:0.166.0-0.1.hum1@src",
          "Red Hat Hardened Images:hugo-0:0.166.0-0.1.hum1@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-100692"
        },
        {
          "category": "external",
          "summary": "RHBZ#2541910",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2541910"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-100692",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-100692"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-100692",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-100692"
        },
        {
          "category": "external",
          "summary": "https://github.com/gohugoio/hugo/security/advisories/GHSA-797m-7j5g-3rpr",
          "url": "https://github.com/gohugoio/hugo/security/advisories/GHSA-797m-7j5g-3rpr"
        },
        {
          "category": "external",
          "summary": "https://www.vulncheck.com/advisories/hugo-before-0.166.0-path-traversal-via-symlinked-mount-roots",
          "url": "https://www.vulncheck.com/advisories/hugo-before-0.166.0-path-traversal-via-symlinked-mount-roots"
        }
      ],
      "release_date": "2026-09-26T13:23:50.847000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-09T23:14:36+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:hugo-0:0.166.0-0.1.hum1@aarch64",
            "Red Hat Hardened Images:hugo-0:0.166.0-0.1.hum1@src",
            "Red Hat Hardened Images:hugo-0:0.166.0-0.1.hum1@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:66266"
        },
        {
          "category": "workaround",
          "details": "Inspect checked-in themes and vendored modules for symlinks at mount roots before building. Build untrusted content in an isolated environment without access to sensitive host files.",
          "product_ids": [
            "Red Hat Hardened Images:hugo-0:0.166.0-0.1.hum1@aarch64",
            "Red Hat Hardened Images:hugo-0:0.166.0-0.1.hum1@src",
            "Red Hat Hardened Images:hugo-0:0.166.0-0.1.hum1@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:hugo-0:0.166.0-0.1.hum1@aarch64",
            "Red Hat Hardened Images:hugo-0:0.166.0-0.1.hum1@src",
            "Red Hat Hardened Images:hugo-0:0.166.0-0.1.hum1@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "github.com/gohugoio/hugo: Hugo: Information disclosure via symlinked mount roots"
    },
    {
      "cve": "CVE-2026-100693",
      "cwe": {
        "id": "CWE-918",
        "name": "Server-Side Request Forgery"
      },
      "discovery_date": "2026-09-26T13:33:01.116534+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2541830"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Hugo. Case-sensitive validation in the URL deny rule mechanism allows an attacker to bypass access restrictions. By supplying mixed-case URL schemes when fetching remote resources, an attacker can access restricted network destinations, such as localhost or internal IP addresses. This may lead to unauthorized access to internal network services and information disclosure.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "github.com/gohugoio/hugo: Hugo: Security restriction bypass via mixed-case URL schemes",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates this flaw Moderate. In historical Hummingbird Hugo builds, an untrusted URL passed to resources.GetRemote could bypass the default IP-literal deny rule by using a mixed-case scheme, allowing the build process to fetch restricted network resources. The current Hummingbird Hugo package contains the fix. Other identified product affects are not vulnerable because their Hugo dependency versions predate the flaw or the shipped Grafana packages do not execute Hugo.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:hugo-0:0.166.0-0.1.hum1@aarch64",
          "Red Hat Hardened Images:hugo-0:0.166.0-0.1.hum1@src",
          "Red Hat Hardened Images:hugo-0:0.166.0-0.1.hum1@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-100693"
        },
        {
          "category": "external",
          "summary": "RHBZ#2541830",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2541830"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-100693",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-100693"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-100693",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-100693"
        },
        {
          "category": "external",
          "summary": "https://github.com/gohugoio/hugo/security/advisories/GHSA-pmrv-x7gp-2rjw",
          "url": "https://github.com/gohugoio/hugo/security/advisories/GHSA-pmrv-x7gp-2rjw"
        },
        {
          "category": "external",
          "summary": "https://www.vulncheck.com/advisories/hugo-0.162.0-before-0.166.0-ip-literal-deny-rule-bypass",
          "url": "https://www.vulncheck.com/advisories/hugo-0.162.0-before-0.166.0-ip-literal-deny-rule-bypass"
        }
      ],
      "release_date": "2026-09-26T13:23:51.556000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-09T23:14:36+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:hugo-0:0.166.0-0.1.hum1@aarch64",
            "Red Hat Hardened Images:hugo-0:0.166.0-0.1.hum1@src",
            "Red Hat Hardened Images:hugo-0:0.166.0-0.1.hum1@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:66266"
        },
        {
          "category": "workaround",
          "details": "Do not pass untrusted URLs to resources.GetRemote. Where remote fetching is required, configure security.http.urls with an explicit allowlist of trusted hosts.",
          "product_ids": [
            "Red Hat Hardened Images:hugo-0:0.166.0-0.1.hum1@aarch64",
            "Red Hat Hardened Images:hugo-0:0.166.0-0.1.hum1@src",
            "Red Hat Hardened Images:hugo-0:0.166.0-0.1.hum1@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 4.0,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:hugo-0:0.166.0-0.1.hum1@aarch64",
            "Red Hat Hardened Images:hugo-0:0.166.0-0.1.hum1@src",
            "Red Hat Hardened Images:hugo-0:0.166.0-0.1.hum1@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "github.com/gohugoio/hugo: Hugo: Security restriction bypass via mixed-case URL schemes"
    },
    {
      "cve": "CVE-2026-100694",
      "cwe": {
        "id": "CWE-79",
        "name": "Improper Neutralization of Input During Web Page Generation"
      },
      "discovery_date": "2026-09-26T13:31:03.538484+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2541804"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Hugo. When processing content files mapped to the Org Mode media type, Hugo renders raw HTML export blocks and snippets without proper escaping. An attacker who can influence or supply content files can exploit this vulnerability to conduct cross-site scripting (XSS), executing malicious scripts in the web browsers of users viewing the generated site.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "github.com/gohugoio/hugo: Hugo: Cross-site scripting via unescaped HTML in Org Mode content",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated as Moderate severity because successful exploitation requires an attacker to supply or influence source files declaring the Org Mode format, significantly narrowing the exposure. In Red Hat environments, Hugo and embedded components operate within static build pipelines that compile verified source repositories. The risk is limited to client browsers accessing rendered pages that incorporate unvetted Org Mode input, while deployments utilizing trusted content sources remain unaffected.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:hugo-0:0.166.0-0.1.hum1@aarch64",
          "Red Hat Hardened Images:hugo-0:0.166.0-0.1.hum1@src",
          "Red Hat Hardened Images:hugo-0:0.166.0-0.1.hum1@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-100694"
        },
        {
          "category": "external",
          "summary": "RHBZ#2541804",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2541804"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-100694",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-100694"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-100694",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-100694"
        },
        {
          "category": "external",
          "summary": "https://github.com/gohugoio/hugo/security/advisories/GHSA-pq74-mj4h-cjq2",
          "url": "https://github.com/gohugoio/hugo/security/advisories/GHSA-pq74-mj4h-cjq2"
        },
        {
          "category": "external",
          "summary": "https://www.vulncheck.com/advisories/hugo-before-0.166.0-cross-site-scripting-via-text-org",
          "url": "https://www.vulncheck.com/advisories/hugo-before-0.166.0-cross-site-scripting-via-text-org"
        }
      ],
      "release_date": "2026-09-26T13:23:52.256000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-09T23:14:36+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:hugo-0:0.166.0-0.1.hum1@aarch64",
            "Red Hat Hardened Images:hugo-0:0.166.0-0.1.hum1@src",
            "Red Hat Hardened Images:hugo-0:0.166.0-0.1.hum1@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:66266"
        },
        {
          "category": "workaround",
          "details": "There is no mitigation available for this issue. Red Hat recommends that customers update to the latest available version that contains the fix.",
          "product_ids": [
            "Red Hat Hardened Images:hugo-0:0.166.0-0.1.hum1@aarch64",
            "Red Hat Hardened Images:hugo-0:0.166.0-0.1.hum1@src",
            "Red Hat Hardened Images:hugo-0:0.166.0-0.1.hum1@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:hugo-0:0.166.0-0.1.hum1@aarch64",
            "Red Hat Hardened Images:hugo-0:0.166.0-0.1.hum1@src",
            "Red Hat Hardened Images:hugo-0:0.166.0-0.1.hum1@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "github.com/gohugoio/hugo: Hugo: Cross-site scripting via unescaped HTML in Org Mode content"
    }
  ]
}