Hugo CVE-2026-58404

Exploitation requires all of the following conditions to be met simultaneously: (1) Hugo version exactly v0.162.0 or v0.163.0 - earlier and later versions are not affected; (2) the build must use the cgo-linked system resolver, not the pure-Go resolver (CGO_ENABLED=1 at build time, which is the default for most distributed Hugo binaries); (3) at least one site template must invoke resources.GetRemote with a URL value that is data-derived or otherwise influenced by an attacker rather than a hardcoded string; (4) the attacker must have a mechanism to inject an alternate-encoded IP address into that URL argument, such as contributor access to data files, configuration, or content front matter. Exploitation is strictly limited to build time - no impact on the statically served site output or end-user browsers. Targets are restricted to services reachable from the build host: loopback services, RFC-1918 internal hosts, and the cloud-metadata endpoint. Sites where resources.GetRemote is only ever called with hardcoded, trusted URLs are not exploitable regardless of Hugo version or resolver configuration.

The official CVSS 4.0 score is 4.6 (CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N). The AT:P (attack requirements present) modifier is the key signal here: exploitation is gated on a specific runtime condition - the cgo system resolver must be active - and on a template design that passes externally-influenced URLs to resources.GetRemote. The raw 4.6 score understates the potential business impact in cloud-hosted CI contexts: SC:H indicates that the subsequent system (the build host's cloud metadata service or internal network) faces high confidentiality impact, which in practice means IAM credentials or secrets manager tokens could be exfiltrated. Conversely, the score appropriately reflects that this is not a default-configuration mass-exploitation scenario - it requires both a specific resolver mode and attacker influence over template inputs. No EPSS data was provided in the intelligence feed. The vulnerability is not in CISA KEV and no POC has been identified, which lowers immediate response urgency. For teams running Hugo in cloud CI pipelines with any degree of contributor access to template data or data files, real-world risk is meaningfully higher than the 4.6 base score suggests.

An attacker with write access to a Hugo project's data directory or a partial template contributes a URL argument to resources.GetRemote using the decimal-integer encoding of 169.254.169.254 (i.e., 2852039166). When the CI pipeline triggers a Hugo build on a cloud instance - such as GitHub Actions running on AWS - the policy check passes because the integer form is not matched by the deny rule, and the cgo resolver issues an HTTP GET to the cloud metadata endpoint, potentially returning IAM role credentials that are then embedded in the build output or logged. No public proof-of-concept has been identified at time of analysis.