Hugo
Monthly
Case-sensitivity bypass in Hugo's security.http.urls IP-literal deny rule lets builds running v0.162.0 through v0.165.x fetch URLs that the rule was configured to block - a mixed-case scheme such as 'HTTP://localhost/...' evades the deny match, re-enabling SSRF through resources.GetRemote. The issue is unauthenticated (PR:N) but local (AV:L): it only matters when a Hugo build processes attacker-influenced input and the operator depends on the IP-literal deny rule as the SSRF control, and it cannot be triggered against an already-served static site. No public exploit code has been identified and there is no confirmation of active exploitation, but a vendor patch is available in Hugo v0.166.0.
Symlink-following flaws in Hugo's theme and module mount confinement allow files outside a project's mount roots to be read during a site build and, via static mounts, published into the public/ output directory. The flaw affects Hugo builds after v0.123.0 and before v0.166.0 for any project that adopts an untrusted theme checked into themes/ or a vendored (non-Go-modules) module containing a symlink at a mount root and then runs a build; the vendor scores this 8.7 (High) under CVSS 4.0, while independent analysis models it as CVSS 3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N because the site operator must first adopt the malicious theme and execute the build. No public exploit code identified at time of analysis and no KEV listing; a vendor-released patch exists in v0.166.0.
Arbitrary file read in Hugo v0.161.0 through v0.165.0 allows an attacker who can contribute content to a Hugo project - for example by opening a pull request - to commit a symlink such as assets/css/x.css pointing to /etc/passwd alongside a PostCSS plugin that reads it, causing any file readable by the build process to be disclosed and potentially published into the generated site. The flaw is remotely triggerable by unauthenticated attackers per the reported vector (PR:N), but in practice it only bites projects that actually invoke Node.js-based asset pipelines (css.PostCSS, css.TailwindCSS, js.Babel) under the default security configuration, and only when the attacker-supplied content is really built - automated CI or deploy-preview builds satisfy this with no human interaction, while review-then-merge workflows require a maintainer to build the change. Impact is confidentiality-only: there is no code execution or write primitive, and no public exploit identified at time of analysis; projects that never call the Node.js tools are unaffected.
Sandbox/permission-restriction bypass in the Hugo static site generator (versions after v0.43, fixed in v0.165.0) lets a Node tool invoked during a build read and write files outside the project's working directory. Because TailwindCSS ships in the default security.exec.allow list and must be run with highly permissive Node flags (--allow-addons, --allow-child-process, --allow-worker), the Node permission model that was supposed to contain build tools (from the fix for GHSA-x597-9fr4-5857) is effectively neutralized. Reported by VulnCheck; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Arbitrary file disclosure in the Hugo static site generator (versions after v0.123.0 and before v0.165.0) lets an attacker read files outside the intended project boundary by planting a symlink in a mounted directory. Because parent-directory symlinks were not dropped during direct resource lookups, functions like resources.Get and os.ReadFile follow the symlink and embed the target file's contents into the built site. Reported by VulnCheck; no public exploit identified at time of analysis, and this is an incomplete-fix follow-up to two prior advisories (GHSA-c3wq-j5vh-68rc and GHSA-fw87-fv5r-9fpw).
Server-side request forgery in Hugo static site generator (versions 0.91.0 through 0.165.0) allows an attacker who can supply a URL through site content - via front-matter fields or a connected CMS - to silently fetch loopback, RFC 1918, or cloud-metadata endpoints during the build process, embedding the internal response directly into the published static output. The security.http.urls allowlist, Hugo's only guard on resources.GetRemote outbound fetches, evaluates hostname strings without performing DNS resolution, meaning any registered domain whose A record points to a private or metadata IP bypasses the policy entirely, and no dial-time hook in the HTTP client provides a second check. No public exploit code has been identified at time of analysis, but the attack requires only DNS control and content-write access, making it operationally straightforward in CI/CD-integrated deployments.
Arbitrary command execution in Hugo 0.162.0 through 0.164.x occurs when the static site generator builds a project whose Tailwind configuration is supplied by an attacker-controlled theme, module, or starter template. Because these releases added tailwindcss to the AllowChildProcess default, Hugo launches the tool with --allow-child-process, and any top-level JavaScript in tailwind.config.js (loaded via require at startup) can spawn a non-Node shell that inherits none of the Node.js permission restrictions and runs with the full privileges of the build account. This is a build-time supply-chain execution flaw with no public exploit identified at time of analysis; it was reported by VulnCheck and fixed in Hugo 0.165.0.
Stored cross-site scripting in the Hugo static site generator (versions v0.60.0 up to but not including v0.167.0) lets anyone holding Markdown content-authoring privileges break out of the href attribute generated for heading anchors by .TableOfContents or .Fragments.ToHTML and inject arbitrary HTML elements carrying event handlers into the rendered page. The issue is scored CVSS 4.0 base 5.1 (CWE-79) and requires low-privileged content access (PR:L) plus a victim viewing the poisoned page (UI:P); because the injected content is only dangerous when Hugo processes Markdown from multiple or untrusted authors, single-author sites built from a fully trusted repository are effectively not exposed. No public exploit code was identified at the time of analysis and the flaw has not been confirmed actively exploited (no CISA KEV listing), making this a moderate-priority hardening item rather than an urgent remote-code-execution-class emergency.
Local file disclosure in Hugo v0.162.0 through v0.166.x allows an attacker-controlled theme or module to place a symlink or NTFS junction at a virtual ancestor directory of a nested mount, causing resources.Match to list and publish files outside the theme/module root during a site build. Affected users must install and build with an untrusted third-party theme or module; exploitation is local to the build host and requires user interaction, with impact limited to disclosure of files readable by the build process. No public exploit identified at time of analysis; vendor-released patch is v0.167.0.
Path traversal in Hugo's asset pipeline lets a malicious theme or module bundle files from outside the project root into published JavaScript or CSS output, affecting Hugo from v0.84.0 up to (but not including) v0.167.0. Exploitation is build-time and supply-chain oriented: a maintainer must install the hostile component and run one of the affected functions (js.Build, js.Batch, or css.Build), and only files readable by the build user can be exfiltrated - there is no remote, unauthenticated exposure of an already-published site. The CVSS v4.0 vector is 6.7 with PR:N (no privileges required) but AV:L and UI:A, meaning local attacker access plus user interaction; no public exploit was identified at time of analysis and no KEV listing applies.
Path traversal in Hugo's css.Sass transpilation pipeline (all versions before v0.167.0) lets a malicious theme or module reference files outside the project root via relative, absolute, or symlinked @import/@use targets and have their contents compiled into the published site CSS. Exploitation is build-time rather than remote: a developer or CI job must voluntarily add the untrusted theme/module and run a build that uses css.Sass, and only files readable by the build process's user can be disclosed - a moderate information-disclosure risk rather than an urgent remote-execution priority. No public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV); the vendor has released a fix in v0.167.0.
Stored cross-site scripting in Hugo's Org Mode rendering path affects the static site generator from v0.56.0 through v0.165.x: content files (or content-adapter output) declared as the text/org media type are rendered with raw HTML passed through unescaped, so Org export blocks and @@html:...@@ snippets are emitted verbatim into the generated site. An attacker with the ability to supply or influence a content file under /content - at least author/contributor-level content privileges per the assessed vector (CVSS:3.1 PR:L) - can plant script that executes in the browsers of visitors who load the affected page (UI:R). Only Org-declared pages are exposed; sites that fully trust all content sources are explicitly not impacted, and this is not confirmed actively exploited (not in CISA KEV) with no public exploit identified at time of analysis, making it a genuine but modest-priority issue rather than a mass-exploitation risk. Version v0.166.0 resolves it by denying text/org by default through a new security.allowContent allowlist.
Stored cross-site scripting in Hugo 0.75.0 through 0.165.x allows an authenticated contributor to inject arbitrary JavaScript into generated sites by supplying a crafted lineAnchors value in a Markdown code fence or a highlight template call. The syntax highlighter passes that value to Chroma without HTML-escaping it, so Chroma writes it verbatim into the id and href attributes of line-number markup, and a visitor who loads the rendered page can execute the injected script. Vendor-released patch: 0.166.0; no public exploit identified at time of analysis, and the independent assessment rates this as a genuine but low-urgency issue because exploitation requires contributor-level content access and relies on untrusted Markdown being published.
Stored cross-site scripting in Hugo's fenced-code-block renderer (versions 0.93.0 through 0.165.0) allows a low-privileged content author to inject arbitrary JavaScript into statically generated HTML pages by embedding crafted attribute values in a code-fence info string. The vulnerability arises because Hugo's `markup/internal/attributes/attributes.go` converts attribute values from byte slices to strings during storage, silently bypassing the escaping branch in `RenderAttributes` that only operates on byte slice types - contradicting the function's own documentation. Every visitor who loads an affected page executes the injected script; no public exploit identified at time of analysis, and exploitation has not been confirmed in CISA KEV.
Symlink traversal in Hugo's virtual filesystem (v0.123.0-v0.163.0) allows a symlink planted inside a theme or local mount to escape the mount sandbox and return the contents of arbitrary files accessible to the OS user running the hugo build. A regression in RootMappingFs.statRoot introduced a Stat call where Lstat was required, silently resolving symlinks that cross mount boundaries. No public exploit code or CISA KEV listing exists; the issue is fixed in v0.163.1.
Stored XSS in Hugo's default code-block renderer allows an attacker with Markdown contribution rights to inject arbitrary JavaScript into generated static pages. Hugo versions 0.60.0 through 0.163.2 write the code-fence info-string (language identifier) directly into HTML attribute values without escaping, so a crafted info-string containing a quote character and script payload breaks out of the attribute context. No public exploit or KEV listing exists at time of analysis; the CVSS 4.0 score of 5.1 reflects the requirement for prior write access and victim interaction.
Build-time SSRF in Hugo static site generator (v0.162.0-v0.163.0) allows bypass of the `security.http.urls` IP-block policy by supplying loopback or cloud-metadata addresses in alternate IPv4 encodings - integer, hex, or octal - that the deny rule does not recognize but the cgo system resolver silently normalizes and resolves. Templates invoking `resources.GetRemote` with attacker-influenced or data-derived URLs can reach internal services and cloud-metadata endpoints (e.g., AWS IMDSv1) at build time, a particularly acute risk in CI pipelines and hosted build services where instance credentials are accessible. No public exploit has been identified and the vulnerability is not listed in CISA KEV, but the fix is available in v0.163.1.
Hugo is a fast and Flexible Static Site Generator built in Go. Rated high severity (CVSS 8.5), this vulnerability is remotely exploitable. Public exploit code available.
Case-sensitivity bypass in Hugo's security.http.urls IP-literal deny rule lets builds running v0.162.0 through v0.165.x fetch URLs that the rule was configured to block - a mixed-case scheme such as 'HTTP://localhost/...' evades the deny match, re-enabling SSRF through resources.GetRemote. The issue is unauthenticated (PR:N) but local (AV:L): it only matters when a Hugo build processes attacker-influenced input and the operator depends on the IP-literal deny rule as the SSRF control, and it cannot be triggered against an already-served static site. No public exploit code has been identified and there is no confirmation of active exploitation, but a vendor patch is available in Hugo v0.166.0.
Symlink-following flaws in Hugo's theme and module mount confinement allow files outside a project's mount roots to be read during a site build and, via static mounts, published into the public/ output directory. The flaw affects Hugo builds after v0.123.0 and before v0.166.0 for any project that adopts an untrusted theme checked into themes/ or a vendored (non-Go-modules) module containing a symlink at a mount root and then runs a build; the vendor scores this 8.7 (High) under CVSS 4.0, while independent analysis models it as CVSS 3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N because the site operator must first adopt the malicious theme and execute the build. No public exploit code identified at time of analysis and no KEV listing; a vendor-released patch exists in v0.166.0.
Arbitrary file read in Hugo v0.161.0 through v0.165.0 allows an attacker who can contribute content to a Hugo project - for example by opening a pull request - to commit a symlink such as assets/css/x.css pointing to /etc/passwd alongside a PostCSS plugin that reads it, causing any file readable by the build process to be disclosed and potentially published into the generated site. The flaw is remotely triggerable by unauthenticated attackers per the reported vector (PR:N), but in practice it only bites projects that actually invoke Node.js-based asset pipelines (css.PostCSS, css.TailwindCSS, js.Babel) under the default security configuration, and only when the attacker-supplied content is really built - automated CI or deploy-preview builds satisfy this with no human interaction, while review-then-merge workflows require a maintainer to build the change. Impact is confidentiality-only: there is no code execution or write primitive, and no public exploit identified at time of analysis; projects that never call the Node.js tools are unaffected.
Sandbox/permission-restriction bypass in the Hugo static site generator (versions after v0.43, fixed in v0.165.0) lets a Node tool invoked during a build read and write files outside the project's working directory. Because TailwindCSS ships in the default security.exec.allow list and must be run with highly permissive Node flags (--allow-addons, --allow-child-process, --allow-worker), the Node permission model that was supposed to contain build tools (from the fix for GHSA-x597-9fr4-5857) is effectively neutralized. Reported by VulnCheck; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Arbitrary file disclosure in the Hugo static site generator (versions after v0.123.0 and before v0.165.0) lets an attacker read files outside the intended project boundary by planting a symlink in a mounted directory. Because parent-directory symlinks were not dropped during direct resource lookups, functions like resources.Get and os.ReadFile follow the symlink and embed the target file's contents into the built site. Reported by VulnCheck; no public exploit identified at time of analysis, and this is an incomplete-fix follow-up to two prior advisories (GHSA-c3wq-j5vh-68rc and GHSA-fw87-fv5r-9fpw).
Server-side request forgery in Hugo static site generator (versions 0.91.0 through 0.165.0) allows an attacker who can supply a URL through site content - via front-matter fields or a connected CMS - to silently fetch loopback, RFC 1918, or cloud-metadata endpoints during the build process, embedding the internal response directly into the published static output. The security.http.urls allowlist, Hugo's only guard on resources.GetRemote outbound fetches, evaluates hostname strings without performing DNS resolution, meaning any registered domain whose A record points to a private or metadata IP bypasses the policy entirely, and no dial-time hook in the HTTP client provides a second check. No public exploit code has been identified at time of analysis, but the attack requires only DNS control and content-write access, making it operationally straightforward in CI/CD-integrated deployments.
Arbitrary command execution in Hugo 0.162.0 through 0.164.x occurs when the static site generator builds a project whose Tailwind configuration is supplied by an attacker-controlled theme, module, or starter template. Because these releases added tailwindcss to the AllowChildProcess default, Hugo launches the tool with --allow-child-process, and any top-level JavaScript in tailwind.config.js (loaded via require at startup) can spawn a non-Node shell that inherits none of the Node.js permission restrictions and runs with the full privileges of the build account. This is a build-time supply-chain execution flaw with no public exploit identified at time of analysis; it was reported by VulnCheck and fixed in Hugo 0.165.0.
Stored cross-site scripting in the Hugo static site generator (versions v0.60.0 up to but not including v0.167.0) lets anyone holding Markdown content-authoring privileges break out of the href attribute generated for heading anchors by .TableOfContents or .Fragments.ToHTML and inject arbitrary HTML elements carrying event handlers into the rendered page. The issue is scored CVSS 4.0 base 5.1 (CWE-79) and requires low-privileged content access (PR:L) plus a victim viewing the poisoned page (UI:P); because the injected content is only dangerous when Hugo processes Markdown from multiple or untrusted authors, single-author sites built from a fully trusted repository are effectively not exposed. No public exploit code was identified at the time of analysis and the flaw has not been confirmed actively exploited (no CISA KEV listing), making this a moderate-priority hardening item rather than an urgent remote-code-execution-class emergency.
Local file disclosure in Hugo v0.162.0 through v0.166.x allows an attacker-controlled theme or module to place a symlink or NTFS junction at a virtual ancestor directory of a nested mount, causing resources.Match to list and publish files outside the theme/module root during a site build. Affected users must install and build with an untrusted third-party theme or module; exploitation is local to the build host and requires user interaction, with impact limited to disclosure of files readable by the build process. No public exploit identified at time of analysis; vendor-released patch is v0.167.0.
Path traversal in Hugo's asset pipeline lets a malicious theme or module bundle files from outside the project root into published JavaScript or CSS output, affecting Hugo from v0.84.0 up to (but not including) v0.167.0. Exploitation is build-time and supply-chain oriented: a maintainer must install the hostile component and run one of the affected functions (js.Build, js.Batch, or css.Build), and only files readable by the build user can be exfiltrated - there is no remote, unauthenticated exposure of an already-published site. The CVSS v4.0 vector is 6.7 with PR:N (no privileges required) but AV:L and UI:A, meaning local attacker access plus user interaction; no public exploit was identified at time of analysis and no KEV listing applies.
Path traversal in Hugo's css.Sass transpilation pipeline (all versions before v0.167.0) lets a malicious theme or module reference files outside the project root via relative, absolute, or symlinked @import/@use targets and have their contents compiled into the published site CSS. Exploitation is build-time rather than remote: a developer or CI job must voluntarily add the untrusted theme/module and run a build that uses css.Sass, and only files readable by the build process's user can be disclosed - a moderate information-disclosure risk rather than an urgent remote-execution priority. No public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV); the vendor has released a fix in v0.167.0.
Stored cross-site scripting in Hugo's Org Mode rendering path affects the static site generator from v0.56.0 through v0.165.x: content files (or content-adapter output) declared as the text/org media type are rendered with raw HTML passed through unescaped, so Org export blocks and @@html:...@@ snippets are emitted verbatim into the generated site. An attacker with the ability to supply or influence a content file under /content - at least author/contributor-level content privileges per the assessed vector (CVSS:3.1 PR:L) - can plant script that executes in the browsers of visitors who load the affected page (UI:R). Only Org-declared pages are exposed; sites that fully trust all content sources are explicitly not impacted, and this is not confirmed actively exploited (not in CISA KEV) with no public exploit identified at time of analysis, making it a genuine but modest-priority issue rather than a mass-exploitation risk. Version v0.166.0 resolves it by denying text/org by default through a new security.allowContent allowlist.
Stored cross-site scripting in Hugo 0.75.0 through 0.165.x allows an authenticated contributor to inject arbitrary JavaScript into generated sites by supplying a crafted lineAnchors value in a Markdown code fence or a highlight template call. The syntax highlighter passes that value to Chroma without HTML-escaping it, so Chroma writes it verbatim into the id and href attributes of line-number markup, and a visitor who loads the rendered page can execute the injected script. Vendor-released patch: 0.166.0; no public exploit identified at time of analysis, and the independent assessment rates this as a genuine but low-urgency issue because exploitation requires contributor-level content access and relies on untrusted Markdown being published.
Stored cross-site scripting in Hugo's fenced-code-block renderer (versions 0.93.0 through 0.165.0) allows a low-privileged content author to inject arbitrary JavaScript into statically generated HTML pages by embedding crafted attribute values in a code-fence info string. The vulnerability arises because Hugo's `markup/internal/attributes/attributes.go` converts attribute values from byte slices to strings during storage, silently bypassing the escaping branch in `RenderAttributes` that only operates on byte slice types - contradicting the function's own documentation. Every visitor who loads an affected page executes the injected script; no public exploit identified at time of analysis, and exploitation has not been confirmed in CISA KEV.
Symlink traversal in Hugo's virtual filesystem (v0.123.0-v0.163.0) allows a symlink planted inside a theme or local mount to escape the mount sandbox and return the contents of arbitrary files accessible to the OS user running the hugo build. A regression in RootMappingFs.statRoot introduced a Stat call where Lstat was required, silently resolving symlinks that cross mount boundaries. No public exploit code or CISA KEV listing exists; the issue is fixed in v0.163.1.
Stored XSS in Hugo's default code-block renderer allows an attacker with Markdown contribution rights to inject arbitrary JavaScript into generated static pages. Hugo versions 0.60.0 through 0.163.2 write the code-fence info-string (language identifier) directly into HTML attribute values without escaping, so a crafted info-string containing a quote character and script payload breaks out of the attribute context. No public exploit or KEV listing exists at time of analysis; the CVSS 4.0 score of 5.1 reflects the requirement for prior write access and victim interaction.
Build-time SSRF in Hugo static site generator (v0.162.0-v0.163.0) allows bypass of the `security.http.urls` IP-block policy by supplying loopback or cloud-metadata addresses in alternate IPv4 encodings - integer, hex, or octal - that the deny rule does not recognize but the cgo system resolver silently normalizes and resolves. Templates invoking `resources.GetRemote` with attacker-influenced or data-derived URLs can reach internal services and cloud-metadata endpoints (e.g., AWS IMDSv1) at build time, a particularly acute risk in CI pipelines and hosted build services where instance credentials are accessible. No public exploit has been identified and the vulnerability is not listed in CISA KEV, but the fix is available in v0.163.1.
Hugo is a fast and Flexible Static Site Generator built in Go. Rated high severity (CVSS 8.5), this vulnerability is remotely exploitable. Public exploit code available.