CVE-2024-55601

Hugo is a static site generator. Starting in version 0.123.0 and prior to version 0.139.4, some HTML attributes in Markdown in the internal templates listed below not escaped in internal render hooks. Those whoa re impacted are Hugo users who do not trust their Markdown content files and are using one or more of these templates: `_default/_markup/render-link.html` from `v0.123.0`; `_default/_markup/render-image.html` from `v0.123.0`; `_default/_markup/render-table.html` from `v0.134.0`; and/or `shortcodes/youtube.html` from `v0.125.0`. This issue is patched in v0.139.4. As a workaround, one may replace an affected component with user defined templates or disable the internal templates.

• CWE-79

• https://github.com/gohugoio/hugo/commit/54398f8d572c689f9785d59e907fd910a23401b0
• https://github.com/gohugoio/hugo/releases/tag/v0.139.4
• https://github.com/gohugoio/hugo/security/advisories/GHSA-c2xf-9v2r-r2rx
• https://gohugo.io/getting-started/configuration-markup/#renderhooksimageenabledefault

Published

Dec 9, 2024

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-55593A improper neutralization of special elements used in an sql…2.7
• CVE-2024-55594An improper handling of syntactically invalid structure in F…9.8
• CVE-2024-55595Rejected reason: Not used
• CVE-2024-55597A improper limitation of a pathname to a restricted director…7.2
• CVE-2024-55599An Improperly Implemented Security Check for Standard vulner…5.3
• CVE-2024-5560CWE-125: Out-of-bounds Read vulnerability exists that could …7.5
• CVE-2024-55602PwnDoc is a penetration test report generator. Prior to comm…8.5
• CVE-2024-55603Kanboard is project management software that focuses on the …6.5
• CVE-2024-55604Appsmith is a platform to build admin panels, internal tools…4.3
• CVE-2024-55605Suricata is a network Intrusion Detection System, Intrusion …7.5
• CVE-2024-5561The Popup Maker WordPress plugin before 1.19.1 does not san…4.8
• CVE-2024-55626Suricata is a network Intrusion Detection System, Intrusion …5.5