Hugo
Monthly
Stored cross-site scripting in Hugo's fenced-code-block renderer (versions 0.93.0 through 0.165.0) allows a low-privileged content author to inject arbitrary JavaScript into statically generated HTML pages by embedding crafted attribute values in a code-fence info string. The vulnerability arises because Hugo's `markup/internal/attributes/attributes.go` converts attribute values from byte slices to strings during storage, silently bypassing the escaping branch in `RenderAttributes` that only operates on byte slice types - contradicting the function's own documentation. Every visitor who loads an affected page executes the injected script; no public exploit identified at time of analysis, and exploitation has not been confirmed in CISA KEV.
Server-side request forgery in Hugo static site generator (versions 0.91.0 through 0.165.0) allows an attacker who can supply a URL through site content - via front-matter fields or a connected CMS - to silently fetch loopback, RFC 1918, or cloud-metadata endpoints during the build process, embedding the internal response directly into the published static output. The security.http.urls allowlist, Hugo's only guard on resources.GetRemote outbound fetches, evaluates hostname strings without performing DNS resolution, meaning any registered domain whose A record points to a private or metadata IP bypasses the policy entirely, and no dial-time hook in the HTTP client provides a second check. No public exploit code has been identified at time of analysis, but the attack requires only DNS control and content-write access, making it operationally straightforward in CI/CD-integrated deployments.
Arbitrary command execution in Hugo 0.162.0 through 0.164.x occurs when the static site generator builds a project whose Tailwind configuration is supplied by an attacker-controlled theme, module, or starter template. Because these releases added tailwindcss to the AllowChildProcess default, Hugo launches the tool with --allow-child-process, and any top-level JavaScript in tailwind.config.js (loaded via require at startup) can spawn a non-Node shell that inherits none of the Node.js permission restrictions and runs with the full privileges of the build account. This is a build-time supply-chain execution flaw with no public exploit identified at time of analysis; it was reported by VulnCheck and fixed in Hugo 0.165.0.
Symlink traversal in Hugo's virtual filesystem (v0.123.0-v0.163.0) allows a symlink planted inside a theme or local mount to escape the mount sandbox and return the contents of arbitrary files accessible to the OS user running the hugo build. A regression in RootMappingFs.statRoot introduced a Stat call where Lstat was required, silently resolving symlinks that cross mount boundaries. No public exploit code or CISA KEV listing exists; the issue is fixed in v0.163.1.
Stored XSS in Hugo's default code-block renderer allows an attacker with Markdown contribution rights to inject arbitrary JavaScript into generated static pages. Hugo versions 0.60.0 through 0.163.2 write the code-fence info-string (language identifier) directly into HTML attribute values without escaping, so a crafted info-string containing a quote character and script payload breaks out of the attribute context. No public exploit or KEV listing exists at time of analysis; the CVSS 4.0 score of 5.1 reflects the requirement for prior write access and victim interaction.
Build-time SSRF in Hugo static site generator (v0.162.0-v0.163.0) allows bypass of the `security.http.urls` IP-block policy by supplying loopback or cloud-metadata addresses in alternate IPv4 encodings - integer, hex, or octal - that the deny rule does not recognize but the cgo system resolver silently normalizes and resolves. Templates invoking `resources.GetRemote` with attacker-influenced or data-derived URLs can reach internal services and cloud-metadata endpoints (e.g., AWS IMDSv1) at build time, a particularly acute risk in CI pipelines and hosted build services where instance credentials are accessible. No public exploit has been identified and the vulnerability is not listed in CISA KEV, but the fix is available in v0.163.1.
Hugo is a fast and Flexible Static Site Generator built in Go. Rated high severity (CVSS 8.5), this vulnerability is remotely exploitable. Public exploit code available.
Stored cross-site scripting in Hugo's fenced-code-block renderer (versions 0.93.0 through 0.165.0) allows a low-privileged content author to inject arbitrary JavaScript into statically generated HTML pages by embedding crafted attribute values in a code-fence info string. The vulnerability arises because Hugo's `markup/internal/attributes/attributes.go` converts attribute values from byte slices to strings during storage, silently bypassing the escaping branch in `RenderAttributes` that only operates on byte slice types - contradicting the function's own documentation. Every visitor who loads an affected page executes the injected script; no public exploit identified at time of analysis, and exploitation has not been confirmed in CISA KEV.
Server-side request forgery in Hugo static site generator (versions 0.91.0 through 0.165.0) allows an attacker who can supply a URL through site content - via front-matter fields or a connected CMS - to silently fetch loopback, RFC 1918, or cloud-metadata endpoints during the build process, embedding the internal response directly into the published static output. The security.http.urls allowlist, Hugo's only guard on resources.GetRemote outbound fetches, evaluates hostname strings without performing DNS resolution, meaning any registered domain whose A record points to a private or metadata IP bypasses the policy entirely, and no dial-time hook in the HTTP client provides a second check. No public exploit code has been identified at time of analysis, but the attack requires only DNS control and content-write access, making it operationally straightforward in CI/CD-integrated deployments.
Arbitrary command execution in Hugo 0.162.0 through 0.164.x occurs when the static site generator builds a project whose Tailwind configuration is supplied by an attacker-controlled theme, module, or starter template. Because these releases added tailwindcss to the AllowChildProcess default, Hugo launches the tool with --allow-child-process, and any top-level JavaScript in tailwind.config.js (loaded via require at startup) can spawn a non-Node shell that inherits none of the Node.js permission restrictions and runs with the full privileges of the build account. This is a build-time supply-chain execution flaw with no public exploit identified at time of analysis; it was reported by VulnCheck and fixed in Hugo 0.165.0.
Symlink traversal in Hugo's virtual filesystem (v0.123.0-v0.163.0) allows a symlink planted inside a theme or local mount to escape the mount sandbox and return the contents of arbitrary files accessible to the OS user running the hugo build. A regression in RootMappingFs.statRoot introduced a Stat call where Lstat was required, silently resolving symlinks that cross mount boundaries. No public exploit code or CISA KEV listing exists; the issue is fixed in v0.163.1.
Stored XSS in Hugo's default code-block renderer allows an attacker with Markdown contribution rights to inject arbitrary JavaScript into generated static pages. Hugo versions 0.60.0 through 0.163.2 write the code-fence info-string (language identifier) directly into HTML attribute values without escaping, so a crafted info-string containing a quote character and script payload breaks out of the attribute context. No public exploit or KEV listing exists at time of analysis; the CVSS 4.0 score of 5.1 reflects the requirement for prior write access and victim interaction.
Build-time SSRF in Hugo static site generator (v0.162.0-v0.163.0) allows bypass of the `security.http.urls` IP-block policy by supplying loopback or cloud-metadata addresses in alternate IPv4 encodings - integer, hex, or octal - that the deny rule does not recognize but the cgo system resolver silently normalizes and resolves. Templates invoking `resources.GetRemote` with attacker-influenced or data-derived URLs can reach internal services and cloud-metadata endpoints (e.g., AWS IMDSv1) at build time, a particularly acute risk in CI pipelines and hosted build services where instance credentials are accessible. No public exploit has been identified and the vulnerability is not listed in CISA KEV, but the fix is available in v0.163.1.
Hugo is a fast and Flexible Static Site Generator built in Go. Rated high severity (CVSS 8.5), this vulnerability is remotely exploitable. Public exploit code available.