Packages / Debian 12 (Bookworm) / web / hugo

Package: hugo (0.111.3-1)

Fast and flexible Static Site Generator written in Go

Other Packages Related to hugo:

dep: [libsass1] (>= 3.6.5)
C/C++ port of the Sass CSS precompiler
dep: [libc6] (>= 2.34)
GNU C Library: Shared libraries
dep: [libwebp7] (>= 1.2.4)
Lossy compression of digital photographic images

rec: [git]
fast, scalable, distributed revision control system
rec: [golang-any]
Go programming language -- gccgo on "non-Go" platforms

sug: [asciidoctor]
AsciiDoc to HTML rendering for Ruby
sug: [npm]
package manager for Node.js
sug: [pandoc]
general markup converter
sug: [python3-docutils]
text processing system for reStructuredText (implemented in Python 3)

Download hugo

Architecture	Package size	Installed size	Files	Package
amd64	11 MiB	51 MiB	list of files	Download
arm64	9.8 MiB	49 MiB	list of files	Download

Package file paths (46)

Paths come from the repository package-file index for the observed builds. They describe archive/package associations, not every file that will exist on a running system after maintainer scripts, alternatives, generated state, diversions, or installation choices.

/usr/bin/hugo
/usr/share/bash-completion/completions/hugo
/usr/share/doc/hugo/changelog.Debian.gz
/usr/share/doc/hugo/copyright
/usr/share/fish/vendor_completions.d/hugo.fish
/usr/share/man/man1/hugo.1.gz
/usr/share/man/man1/hugo-completion.1.gz
/usr/share/man/man1/hugo-completion-bash.1.gz
/usr/share/man/man1/hugo-completion-fish.1.gz
/usr/share/man/man1/hugo-completion-powershell.1.gz
/usr/share/man/man1/hugo-completion-zsh.1.gz
/usr/share/man/man1/hugo-config.1.gz
/usr/share/man/man1/hugo-config-mounts.1.gz
/usr/share/man/man1/hugo-convert.1.gz
/usr/share/man/man1/hugo-convert-toJSON.1.gz
/usr/share/man/man1/hugo-convert-toTOML.1.gz
/usr/share/man/man1/hugo-convert-toYAML.1.gz
/usr/share/man/man1/hugo-deploy.1.gz
/usr/share/man/man1/hugo-env.1.gz
/usr/share/man/man1/hugo-gen.1.gz
/usr/share/man/man1/hugo-gen-chromastyles.1.gz
/usr/share/man/man1/hugo-gen-doc.1.gz
/usr/share/man/man1/hugo-gen-man.1.gz
/usr/share/man/man1/hugo-import.1.gz
/usr/share/man/man1/hugo-import-jekyll.1.gz
/usr/share/man/man1/hugo-list.1.gz
/usr/share/man/man1/hugo-list-all.1.gz
/usr/share/man/man1/hugo-list-drafts.1.gz
/usr/share/man/man1/hugo-list-expired.1.gz
/usr/share/man/man1/hugo-list-future.1.gz
/usr/share/man/man1/hugo-mod.1.gz
/usr/share/man/man1/hugo-mod-clean.1.gz
/usr/share/man/man1/hugo-mod-get.1.gz
/usr/share/man/man1/hugo-mod-graph.1.gz
/usr/share/man/man1/hugo-mod-init.1.gz
/usr/share/man/man1/hugo-mod-npm.1.gz
/usr/share/man/man1/hugo-mod-npm-pack.1.gz
/usr/share/man/man1/hugo-mod-tidy.1.gz
/usr/share/man/man1/hugo-mod-vendor.1.gz
/usr/share/man/man1/hugo-mod-verify.1.gz
/usr/share/man/man1/hugo-new.1.gz
/usr/share/man/man1/hugo-new-site.1.gz
/usr/share/man/man1/hugo-new-theme.1.gz
/usr/share/man/man1/hugo-server.1.gz
/usr/share/man/man1/hugo-version.1.gz
/usr/share/zsh/vendor-completions/_hugo

Field source: Debian 12 (Bookworm) main amd64

Use this package

OpenFactory can boot this operating system in a browser VM, or start a build that includes the native package name from this record.

Try Debian 12 (Bookworm) in the browser Build an image that includes hugo

Versions, suites, and repositories

Each row is recorded package-index metadata for one version, architecture, suite, and repository. Names, URLs, and sizes are source-reported; a link is a potentially mutable retrieval location, not an OpenFactory redistribution claim or proof that OpenFactory retained the artifact bytes.

Version	Release	Architecture	Repository	Package size	Installed size	Publisher repository artifact
0.111.3-1	bookworm / main	amd64	Debian 12 · main · amd64	11 MiB	51 MiB	pool/main/h/hugo/hugo_0.111.3-1_amd64.deb
0.111.3-1	bookworm / main	arm64	Debian 12 · main · arm64	9.8 MiB	49 MiB	pool/main/h/hugo/hugo_0.111.3-1_arm64.deb

Field source: Debian 12 (Bookworm) main amd64

Known vulnerabilities

Matching against OpenFactory catalog package versions is in progress.

CVE	Severity	Version impact
[CVE-2026-109597] Published: Oct 12, 2026, 10:21:51 PM UTC Hugo from v0.60.0 before v0.167.0 contains a stored cross-site scripting vulnerability that allows Markdown content authors to inject HTML by supplying crafted explicit heading IDs. Attackers can brea	Medium(5.4)	Affected Details (2) `0.111.3-1` · amd64 · bookworm Affected nvd · hugo · debian · bookworm; nvd · hugo · debian · 12 `0.111.3-1` · arm64 · bookworm Affected nvd · hugo · debian · bookworm; nvd · hugo · debian · 12
[CVE-2026-109595] Published: Oct 12, 2026, 10:21:50 PM UTC Hugo from v0.84.0 before v0.167.0 contains a path traversal vulnerability that allows malicious themes or modules to read files outside the project root via ESBuild's fallback resolver in js.Build, js	Medium(6.7)	Affected Details (2) `0.111.3-1` · amd64 · bookworm Affected nvd · hugo · debian · bookworm; nvd · hugo · debian · 12 `0.111.3-1` · arm64 · bookworm Affected nvd · hugo · debian · bookworm; nvd · hugo · debian · 12
[CVE-2026-109574] Published: Oct 12, 2026, 10:21:50 PM UTC Hugo before v0.167.0 contains a path traversal vulnerability in css.Sass that allows malicious themes or modules to read files outside the project root through the Sass compiler's import fallback. Att	Medium(6.7)	Affected Details (2) `0.111.3-1` · amd64 · bookworm Affected nvd · hugo · debian · bookworm; nvd · hugo · debian · 12 `0.111.3-1` · arm64 · bookworm Affected nvd · hugo · debian · bookworm; nvd · hugo · debian · 12
[CVE-2026-89258] Published: Sep 11, 2026, 11:15:34 AM UTC Hugo is a static site generator. In versions after v0.123.0 and before v0.165.0, symlinks in parent directories were not dropped during direct resource lookups, allowing path confinement to be bypasse	Critical(9.3)	Affected Details (2) `0.111.3-1` · amd64 · bookworm Affected nvd · hugo · debian · bookworm; nvd · hugo · debian · 12 `0.111.3-1` · arm64 · bookworm Affected nvd · hugo · debian · bookworm; nvd · hugo · debian · 12
[CVE-2026-100691] Published: Sep 9, 2026, 11:14:36 PM UTC Hugo versions 0.75.0 through 0.165.x contain a stored cross-site scripting vulnerability: the syntax highlighter does not escape the `lineAnchors` option before passing it to Chroma, which writes the	Medium(5.4)	Affected Details (2) `0.111.3-1` · amd64 · bookworm Affected nvd · hugo · debian · bookworm; nvd · hugo · debian · 12 `0.111.3-1` · arm64 · bookworm Affected nvd · hugo · debian · bookworm; nvd · hugo · debian · 12
[CVE-2026-100694] Published: Sep 9, 2026, 11:14:36 PM UTC Hugo is a static site generator. In versions from v0.56.0 through v0.165.x, content files mapped to the text/org media type are rendered without escaping raw HTML: Org export blocks and @@html:...@@ s	Medium(6.1)	Affected Details (2) `0.111.3-1` · amd64 · bookworm Affected nvd · hugo · debian · bookworm; nvd · hugo · debian · 12 `0.111.3-1` · arm64 · bookworm Affected nvd · hugo · debian · bookworm; nvd · hugo · debian · 12
[CVE-2026-10618] Published: Aug 24, 2026, 10:29:10 AM UTC Hugo's default fenced-code-block renderer writes attribute values taken from the code-fence info string into the rendered HTML without escaping them. New in markup/internal/attributes/attributes.go co	Medium(5.4)	Affected Details (2) `0.111.3-1` · amd64 · bookworm Affected nvd · hugo · debian · bookworm; nvd · hugo · debian · 12 `0.111.3-1` · arm64 · bookworm Affected nvd · hugo · debian · bookworm; nvd · hugo · debian · 12
[CVE-2026-10582] Published: Aug 24, 2026, 10:29:09 AM UTC Hugo's security.http.urls allowlist is the only control on outbound fetches made by resources.GetRemote, and it inspects the URL text alone. CheckAllowedHTTPURL in config/security/securityConfig.go ap	High(8.3)	Affected Details (2) `0.111.3-1` · amd64 · bookworm Affected nvd · hugo · debian · bookworm; nvd · hugo · debian · 12 `0.111.3-1` · arm64 · bookworm Affected nvd · hugo · debian · bookworm; nvd · hugo · debian · 12
[CVE-2026-50133] Published: Jul 6, 2026, 7:31:18 PM UTC Hugo is a static site generator. Prior to 0.162.0, Hugo accepts content files in several markup formats. Files mapped to the text/html media type (typically .html files under /content, or pages produc	Medium(6.1)	Affected Details (2) `0.111.3-1` · amd64 · bookworm Affected nvd · hugo · debian · bookworm; nvd · hugo · debian · 12 `0.111.3-1` · arm64 · bookworm Affected nvd · hugo · debian · bookworm; nvd · hugo · debian · 12
[CVE-2026-58402] Published: Jul 6, 2026, 7:19:58 PM UTC Hugo is a static site generator. From 0.60.0 until 0.163.3, Hugo's default code-block renderer wrote the Markdown code-fence language or info-string into the code class="language-…" data-lang="…" wrap	Medium(5.4)	Affected Details (2) `0.111.3-1` · amd64 · bookworm Affected nvd · hugo · debian · bookworm; nvd · hugo · debian · 12 `0.111.3-1` · arm64 · bookworm Affected nvd · hugo · debian · bookworm; nvd · hugo · debian · 12
[CVE-2026-50134] Published: Jun 8, 2026, 6:18:50 PM UTC Hugo is a static site generator. From 0.91.0 until 0.162.0, resources.GetRemote enforces security.http.urls on the URL it is called with, but it did not re-validate intermediate URLs on HTTP 3xx redir	Medium(6.3)	Affected Details (2) `0.111.3-1` · amd64 · bookworm Affected nvd · hugo · debian · bookworm; nvd · hugo · debian · 12 `0.111.3-1` · arm64 · bookworm Affected nvd · hugo · debian · bookworm; nvd · hugo · debian · 12
[CVE-2026-44301] Published: May 12, 2026, 9:37:52 PM UTC Hugo is a static site generator. From 0.43 to before 0.161.0, when building a Hugo site that uses Node-based asset pipelines (PostCSS, Babel, TailwindCSS), Hugo invoked the configured Node tools witho	High(8.1)	Affected Details (2) `0.111.3-1` · amd64 · bookworm Affected nvd · hugo · debian · bookworm; nvd · hugo · debian · 12 `0.111.3-1` · arm64 · bookworm Affected nvd · hugo · debian · bookworm; nvd · hugo · debian · 12
[CVE-2026-35166] Published: Apr 6, 2026, 5:37:05 PM UTC Hugo is a static site generator. From 0.60.0 to before 0.159.2, links and image links in the default markdown to HTML renderer are not properly escaped. Hugo users who trust their Markdown content or	Medium(5.3)	Affected Details (2) `0.111.3-1` · amd64 · bookworm Affected nvd · hugo · debian · bookworm; nvd · hugo · debian · 12 `0.111.3-1` · arm64 · bookworm Affected nvd · hugo · debian · bookworm; nvd · hugo · debian · 12

Fixed and unaffected versions (7)

CVE	Severity	Version impact
[CVE-2026-109596] Published: Oct 12, 2026, 10:21:51 PM UTC Hugo from v0.162.0 before v0.167.0 contains an improper link resolution vulnerability that lets malicious themes or modules expose files outside their root via nested-mount ancestor directories. Attac	Medium(6.7)	Not affected Details (2) `0.111.3-1` · amd64 · bookworm Not affected nvd · hugo · debian · bookworm `0.111.3-1` · arm64 · bookworm Not affected nvd · hugo · debian · bookworm
[CVE-2026-89259] Published: Sep 11, 2026, 12:16:56 PM UTC Hugo is a static site generator. From v0.161.0, Hugo executes Node tools under Node's permission model, but TailwindCSS — included in the default security.exec.allow list — requires a highly permissiv	Critical(9.3)	Not affected Details (2) `0.111.3-1` · amd64 · bookworm Not affected nvd · hugo · debian · bookworm `0.111.3-1` · arm64 · bookworm Not affected nvd · hugo · debian · bookworm
[CVE-2026-100690] Published: Sep 9, 2026, 11:14:36 PM UTC Hugo versions from v0.161.0 through v0.165.0 run Node.js tools (css.PostCSS, css.TailwindCSS, js.Babel) under the Node.js permission model to restrict file system reads to the project directory and co	High(8.7)	Not affected Details (2) `0.111.3-1` · amd64 · bookworm Not affected nvd · hugo · debian · bookworm `0.111.3-1` · arm64 · bookworm Not affected nvd · hugo · debian · bookworm
[CVE-2026-100692] Published: Sep 9, 2026, 11:14:36 PM UTC Hugo is a static site generator. In versions after v0.123.0 and before v0.166.0, Hugo's symlink confinement checks stopped at the mount root itself, so a theme or module checked into themes/ (or a ven	High(8.7)	Not affected Details (2) `0.111.3-1` · amd64 · bookworm Not affected nvd · hugo · debian · bookworm `0.111.3-1` · arm64 · bookworm Not affected nvd · hugo · debian · bookworm
[CVE-2026-100693] Published: Sep 9, 2026, 11:14:36 PM UTC Hugo versions from v0.162.0 before v0.166.0 contain a case-sensitive validation flaw in the security.http.urls IP-literal deny rule that allows attackers to bypass restrictions. Attackers can use mixe	High(8.6)	Not affected Details (2) `0.111.3-1` · amd64 · bookworm Not affected nvd · hugo · debian · bookworm `0.111.3-1` · arm64 · bookworm Not affected nvd · hugo · debian · bookworm
[CVE-2026-75926] Published: Aug 18, 2026, 3:47:49 PM UTC Hugo 0.161.0 placed the Node asset pipelines behind the Node.js permission model so that code running through PostCSS, Babel, or TailwindCSS could not reach the file system outside the project directo	Critical(9.3)	Not affected Details (2) `0.111.3-1` · amd64 · bookworm Not affected nvd · hugo · debian · bookworm `0.111.3-1` · arm64 · bookworm Not affected nvd · hugo · debian · bookworm
[CVE-2026-58403] Published: Jul 6, 2026, 7:25:45 PM UTC Hugo is a static site generator. From v0.123.0 through v0.163.0, Hugo's virtual filesystem is designed so that files under a mount cannot reach outside the mount tree, but a regression caused RootMapp	Medium(6.5)	Not affected Details (2) `0.111.3-1` · amd64 · bookworm Not affected nvd · hugo · debian · bookworm `0.111.3-1` · arm64 · bookworm Not affected nvd · hugo · debian · bookworm

[Next results]

Last synced: Oct 28, 2026, 12:44:10 AM UTC

[CVE catalog]

Checksums

Repository signatures authenticate metadata. Artifact hashing is recorded separately. Neither establishes package safety.

0.111.3-1 / amd64Observed Sep 1, 2026sha256 6c3508f7b0f0…72df586eSource-reported digest

Metadata observed; artifact bytes were not independently fetched or hashed by this catalog import. The digest below is source-reported.

Source-reported digest (sha256): 6c3508f7b0f0009e6f774806dcb061d9ad24782d71b1688c700c016772df586e

Verify download

printf '%s  %s\n' '6c3508f7b0f0009e6f774806dcb061d9ad24782d71b1688c700c016772df586e' 'hugo_0.111.3-1_amd64.deb' | sha256sum --check --strict -

Field source: Debian 12 (Bookworm) main amd64

0.111.3-1 / arm64Observed Sep 1, 2026sha256 6a82dd3e8322…59997da5Source-reported digest

Metadata observed; artifact bytes were not independently fetched or hashed by this catalog import. The digest below is source-reported.

Source-reported digest (sha256): 6a82dd3e832254e8aebe6df88589e29d6ef060a1a52c0ba0ba186c4959997da5

Verify download

printf '%s  %s\n' '6a82dd3e832254e8aebe6df88589e29d6ef060a1a52c0ba0ba186c4959997da5' 'hugo_0.111.3-1_arm64.deb' | sha256sum --check --strict -

Field source: Debian 12 (Bookworm) main arm64

Sources

Debian 12 (Bookworm) main amd64Sep 1, 2026
Authoritative source; repository metadata signature verified
Signature evidence
bookworm-main-amd64:9e0b5aabb2465b3d2e7a7fe27f9913846277833f7a2826e7767acccff5b588c5
Repository-signature verification record
Signed object
https://deb.debian.org/debian/dists/bookworm/InRelease
Signed-object SHA-256
77737fa4b34f2693e982cc9ee35736816c35a7778fc2d326cc1bbf5b301fe1aa
Signer fingerprint
4CB50190207B4758A3F73A796ED0E7B82643E131
Keyring revision
debian-archive-keyring.gpg
SHA-256 506b815cbb32d9b6066b4a2aa524071e071761e7e7f68c3ac74f3061ba852017
Tool and policy
gpgv (GnuPG) 2.4.9
openfactory-software-catalog-signature-v1
Verification time
Sep 1, 2026
Repository metadata hash linkage
Path
main/binary-amd64/Packages.xz
Expected SHA-256
9e0b5aabb2465b3d2e7a7fe27f9913846277833f7a2826e7767acccff5b588c5
Observed SHA-256
9e0b5aabb2465b3d2e7a7fe27f9913846277833f7a2826e7767acccff5b588c5
Result
match verified
Debian 12 (Bookworm) main arm64Sep 1, 2026
Authoritative source; repository metadata signature verified
Signature evidence
bookworm-main-arm64:2ddb1737692e8c45c53e8d57c0ce4cd21c78c5703b830c3226b1423566a06c00
Repository-signature verification record
Signed object
https://deb.debian.org/debian/dists/bookworm/InRelease
Signed-object SHA-256
77737fa4b34f2693e982cc9ee35736816c35a7778fc2d326cc1bbf5b301fe1aa
Signer fingerprint
4CB50190207B4758A3F73A796ED0E7B82643E131
Keyring revision
debian-archive-keyring.gpg
SHA-256 506b815cbb32d9b6066b4a2aa524071e071761e7e7f68c3ac74f3061ba852017
Tool and policy
gpgv (GnuPG) 2.4.9
openfactory-software-catalog-signature-v1
Verification time
Sep 1, 2026
Repository metadata hash linkage
Path
main/binary-arm64/Packages.xz
Expected SHA-256
2ddb1737692e8c45c53e8d57c0ce4cd21c78c5703b830c3226b1423566a06c00
Observed SHA-256
2ddb1737692e8c45c53e8d57c0ce4cd21c78c5703b830c3226b1423566a06c00
Result
match verified