---
id: CVE-2020-26284
aliases:
  - GHSA-8j34-9876-pvfq
title: Hugo can execute a binary from the current directory on Windows
summary: Hugo can execute a binary from the current directory on Windows
severity: high
cvss: 7.7
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N'
vendor: gohugoio
product: github.com/gohugoio/hugo
ecosystem: go
affected:
  - github.com/gohugoio/hugo < 0.79.1
patched:
  - github.com/gohugoio/hugo 0.79.1
published: '2021-06-23'
updated: '2026-07-08'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-8j34-9876-pvfq'
references:
  - url: 'https://github.com/gohugoio/hugo/security/advisories/GHSA-8j34-9876-pvfq'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2020-26284'
  - url: 'https://github.com/golang/go/issues/38736'
tags:
  - osv
  - go
epss: 0.01468
epssPercentile: 0.72636
ingestedAt: '2026-07-09T18:56:36.224Z'
---

## Overview

## Impact

Hugo depends on Go's `os/exec` for certain features, e.g. for rendering of Pandoc documents if these binaries are found in the system `%PATH%` on Windows. However, if a malicious file with the same name (`exe` or `bat`) is found in the current working directory at the time of running `hugo`, the malicious command will be invoked instead of the system one.

Windows users who run `hugo` inside untrusted Hugo sites are affected.

## Patches
Users should upgrade to Hugo v0.79.1.

## Affected packages

- `github.com/gohugoio/hugo < 0.79.1`

## Remediation

Upgrade to a patched release:

- `github.com/gohugoio/hugo 0.79.1`