There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Hugo is a static site generator. Starting in version 0.123.0 and prior to version 0.139.4, some HTML
    attributes in Markdown in the internal templates listed below not escaped in internal render hooks. Those
    whoa re impacted are Hugo users who do not trust their Markdown content files and are using one or more of
    these templates: `_default/_markup/render-link.html` from `v0.123.0`; `_default/_markup/render-image.html`
    from `v0.123.0`; `_default/_markup/render-table.html` from `v0.134.0`; and/or `shortcodes/youtube.html`
    from `v0.125.0`. This issue is patched in v0.139.4. As a workaround, one may replace an affected component
    with user defined templates or disable the internal templates. (CVE-2024-55601)

Linux/Unix 主机中安装的一个或多个程序包受到一个漏洞影响，而供应商没有提供补丁程序。

  - Hugo 是一个静态站点发生器。从 0.123.0 版本到低于 0.139.4版本的下列内部模板的 Markdown 中的某些 HTML 属性在内部渲染挂钩中未转义。受影响的对象是不信任 Markdown 内容文件并使用以下一个或多个模板“v0.123.0”中的“_default/_markup/render-link.html”的 Hugo 用户“v0.123.0”中的“_default/_markup/render-image.html” “v0.134.0”中的“_default/_markup/render-table.html”和/或“v0.125.0”中的“shortcodes/youtube.html”。此问题已在 v0.139.4 中修补。作为变通方案，可使用用户定义的模板替换受影响的组件或禁用内部模板。 (CVE-2024-55601)

请注意，Nessus 依赖供应商报告的程序包是否存在进行判断。

Linux/Unix 主機上安裝了一個或多個受到弱點影響的套件，且供應商未提供可用的修補程式。

  - Hugo 是一個靜態網站產生器。從 0.123.0 版開始及 0.139.4版之前的版本以下所列內部範本的 Markdown 中部分 HTML 屬性未在內部轉譯勾點中逸出。會受到影響的是不信任其 Markdown 內容檔案且使用以下一或多個範本的 Hugo 使用者來自 `v0.123.0` 的 `_default/_markup/render-link.html`來自 `v0.123.0` 的 `_default/_markup/render-image.html`來自 `v0.134.0` 的 `_default/_markup/render-table.html`和/或來自 `v0.125.0` 的 `shortcodes/YouTube.html`。此問題已在 v0.139.4 中修補。因應措施為使用使用者定義的範本取代受影響的元件或停用內部範本。 (CVE-2024-55601)

請注意，Nessus 依賴供應商報告的套件存在。

Linux/Unix ホストには、ベンダーが提供するパッチが利用できない脆弱性の影響を受ける複数のパッケージがインストールされています。

  - Hugo は静的サイトジェネレーターです。バージョン 0.123.0 からバージョン 0.139.4より前のバージョンまで、以下にリストされている内部テンプレートの Markdown の一部の HTML 属性が内部レンダーフックでエスケープされませんでした。影響を受けるのは、Markdownコンテンツファイルを信頼せず、これらのテンプレートの1つ以上を使用しているHugoユーザーです。「v0.123.0」の「_default/_markup/render-link.html」。 「v0.123.0」からの「_default/_markup/render-image.html」 「v0.134.0」からの「_default/_markup/render-table.html」および/または「v0.125.0」からの「shortcodes/sub.html」。この問題は v0.139.4 でパッチされています。回避策として、影響を受けるコンポーネントをユーザー定義のテンプレートで置き換えたり、内部テンプレートを無効にしたりすることができます。CVE-2024-55601

Nessus は、ベンダーによって報告されたパッケージの存在に依存していることに注意してください。

The remote Fedora 45 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-97aa8e408a advisory.

    Update to Hugo 0.169.0, which includes a security fix.

    Menu `pre` and `post` values defined in front matter are no longer rendered as unescaped HTML. Because     front matter is untrusted content, a content contributor could previously inject arbitrary HTML, including     script, into pages that render menu entries. These values are now HTML escaped unless `text/html` is     allowed in `security.allowContent`, and a `warning-menu-pre-post-html-escaped` warning is logged when     markup is escaped. Menu entries defined in the site configuration are not affected.

    This update also requires Go 1.27.0 and continues to build the extended edition with bundled LibSass, so     the package does not depend on a system libsass.

    Release notes: https://github.com/gohugoio/hugo/releases/tag/v0.169.0




Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Hugo is a static site generator. Starting in version 0.123.0 and prior to version 0.139.4, some HTML     attributes in Markdown in the internal templates listed below not escaped in internal render hooks. Those     whoa re impacted are Hugo users who do not trust their Markdown content files and are using one or more of     these templates: `_default/_markup/render-link.html` from `v0.123.0`; `_default/_markup/render-image.html`     from `v0.123.0`; `_default/_markup/render-table.html` from `v0.134.0`; and/or `shortcodes/youtube.html`     from `v0.125.0`. This issue is patched in v0.139.4. As a workaround, one may replace an affected component     with user defined templates or disable the internal templates. (CVE-2024-55601)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-667d0938f0 advisory.

    Update to Hugo 0.165.0, which includes security fixes for several CVEs.

    This release fixes CVE-2026-75926 (Tailwind CSS Node permission model bypass) and CVE-2026-89258 (symlink     confinement bypass), as well as earlier escaping and sandbox issues fixed upstream.

    Fedora 44 provides Go 1.26, and Hugo 0.166.0 and later require Go 1.27.0, so 0.165.0 is the newest release     that can be built for this Fedora release.

    The extended edition is built with bundled LibSass, so the package does not depend on a system libsass.

    Release notes: https://github.com/gohugoio/hugo/releases/tag/v0.165.0



Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-9521359c66 advisory.

    Update to Hugo 0.165.0.

    Fedora 43 provides Go 1.26, and Hugo 0.166.0 and later require Go 1.27.0, so 0.165.0 is the newest release     that can be built for this Fedora release. This update therefore skips 0.167.0 and 0.168.0, neither of     which was published for Fedora 43. It is intended to be the final Hugo update for Fedora 43.

    The extended edition is built with bundled LibSass, so the package does not depend on a system libsass.

    Release notes: https://github.com/gohugoio/hugo/releases/tag/v0.165.0



Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名稱	產品	系列	已發布	已更新	嚴重性
413599	SCA: security update for github.com/gohugoio/hugo (GHSA-c2xf-9v2r-r2rx)	Tenable Self-Hosted Container Security	SCA Checks	2025/1/23	2026/7/2	medium
427788	Alpine: multiple hugo packages: security update to 0.140.1-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	2025/5/30	2026/7/2	medium
413599	SCA: security update for github.com/gohugoio/hugo (GHSA-c2xf-9v2r-r2rx)	Tenable Cloud Security	SCA Checks	2025/1/23	2026/7/2	medium
427788	Alpine: multiple hugo packages: security update to 0.140.1-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	2025/5/30	2026/7/2	medium
248380	Linux Distros 未修补的漏洞：CVE-2024-55601	Nessus	Misc.	2025/8/11	2026/10/29	medium
248380	Linux Distros 未修補的弱點：CVE-2024-55601	Nessus	Misc.	2025/8/11	2026/10/29	medium
248380	Linux Distros のパッチ未適用の脆弱性: CVE-2024-55601	Nessus	Misc.	2025/8/11	2026/10/29	medium
381446	Fedora 45 : hugo (2026-97aa8e408a)	Nessus	Fedora Local Security Checks	2026/11/15	2026/11/15	critical
248380	Linux Distros Unpatched Vulnerability : CVE-2024-55601	Nessus	Misc.	2025/8/11	2026/10/29	medium
381483	Fedora 44 : hugo (2026-667d0938f0)	Nessus	Fedora Local Security Checks	2026/11/15	2026/11/15	critical
381481	Fedora 43 : hugo (2026-9521359c66)	Nessus	Fedora Local Security Checks	2026/11/15	2026/11/15	critical

偵測

搜尋 Plugin

medium

medium

medium

medium

medium

medium

medium

critical

medium

critical

critical