{"id":"CVE-2020-26284","aliases":["GHSA-8j34-9876-pvfq"],"title":"Hugo can execute a binary from the current directory on Windows","summary":"Hugo can execute a binary from the current directory on Windows","severity":"high","cvss":7.7,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N","vendor":"gohugoio","product":"github.com/gohugoio/hugo","ecosystem":"go","affected":["github.com/gohugoio/hugo < 0.79.1"],"patched":["github.com/gohugoio/hugo 0.79.1"],"published":"2021-06-23","updated":"2026-07-08","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-8j34-9876-pvfq","references":[{"url":"https://github.com/gohugoio/hugo/security/advisories/GHSA-8j34-9876-pvfq"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-26284"},{"url":"https://github.com/golang/go/issues/38736"}],"tags":["osv","go"],"epss":0.01468,"epssPercentile":0.72617,"ingestedAt":"2026-07-09T18:56:36.224Z","slug":"CVE-2020-26284","body":"## Overview\n\n## Impact\n\nHugo depends on Go's `os/exec` for certain features, e.g. for rendering of Pandoc documents if these binaries are found in the system `%PATH%` on Windows. However, if a malicious file with the same name (`exe` or `bat`) is found in the current working directory at the time of running `hugo`, the malicious command will be invoked instead of the system one.\n\nWindows users who run `hugo` inside untrusted Hugo sites are affected.\n\n## Patches\nUsers should upgrade to Hugo v0.79.1.\n\n## Affected packages\n\n- `github.com/gohugoio/hugo < 0.79.1`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `github.com/gohugoio/hugo 0.79.1`","depth":"twilight","depthScore":43,"depthScoreParts":{"impact":42.4,"likelihood":0.3,"exploitation":0,"ransomware":0},"changes":[]}