To be clear, those are CVEs in the tooling, not in the generated static sites. Not great, but very different from this WordPress CVE