CVE-2026-10582
HighCVSS 7.4Exploitation Probability (EPSS)
Low risk24th percentile - higher than 24% of all known CVEs
Summary
Hugo does not verify the actual IP address the HTTP client connects to when fetching resources via resources.GetRemote. The security.http.urls allowlist only checks the URL text, not the real destination, allowing access to internal resources.
Risk Assessment
An attacker can supply a URL through content, causing internal data to be fetched and published in the generated site, leading to information disclosure.
Recommendation
Upgrade Hugo to a patched version and consider additional network safeguards for the build process.
Other vulnerabilities in Hugo
See all- CVE-2026-10618Medium
Hugo's default fenced-code-block renderer writes attribute values taken from the code-fence info string into the rendered HTML without escaping them. New code in markup/internal/attributes/attributes.go converts every attribute value from a byte slice to a string, dropping escaping, and RenderAttributes escapes only values that are still byte slices, so its escaping branch is never reached. A quote inside an attribute value can terminate the attribute and allow a further attribute, including an event handler, to be placed on the wrapper element, causing script execution for every visitor who loads the page.
- CVE-2026-75926High
Hugo 0.162.0 added tailwindcss to the default AllowChildProcess list, causing the Node.js process for TailwindCSS to have child process permissions. Top-level code in tailwind.config.js can execute arbitrary commands, bypassing the Node.js permission model.
- CVE-2026-50135Medium
In Hugo from version 0.123.0 to 0.161.1, a regression made RootMappingFs.statRoot use Stat (follows symlinks) instead of Lstat, allowing a symlink planted in a local mount (e.g. a vendored themes/ theme) to read arbitrary files accessible to the Hugo user via resources.Get.
- CVE-2026-58404Medium
A vulnerability in Hugo from v0.162.0 to v0.163.0 allows bypassing the security policy that blocks requests to loopback, internal, and cloud-metadata IPv4 addresses. The policy only matched dotted-decimal notation, so alternative IPv4 encodings (integer, hex, octal) bypassed the block. When a template passes an untrusted URL to resources.GetRemote and the host uses the cgo system resolver, these encodings resolve to blocked addresses, enabling SSRF attacks to internal services and cloud-metadata endpoints in hosted or CI builds.
- CVE-2026-58403Medium
A vulnerability in Hugo (versions 0.123.0 through 0.163.0) allows bypassing virtual filesystem security. A bug in RootMappingFs.statRoot causes symbolic links inside mounted directories to point outside the mount tree, enabling reading arbitrary files accessible to the user running Hugo.
- CVE-2026-58402Medium
Hugo from version 0.60.0 to 0.163.3 by default rendered Markdown code blocks without proper HTML escaping in class and data-lang attributes. An info-string containing a quote and JavaScript payload could break out of the attribute and inject a live script element.
- CVE-2026-50134Medium
In Hugo from version 0.91.0 to 0.162.0, the resources.GetRemote function does not re-validate destination URLs after HTTP 3xx redirects, allowing bypass of the security.http.urls policy. An attacker can redirect the request to a forbidden host, and Hugo will fetch from it.
- CVE-2026-50133Medium
Hugo before version 0.162.0 accepts content files in various markup formats. Files mapped to the text/html media type (e.g., .html files under /content) are emitted verbatim into the rendered page, enabling stored XSS attacks.
Original NVD description (English source)
Hugo's security.http.urls allowlist is the only control on outbound fetches made by resources.GetRemote, and it inspects the URL text alone. CheckAllowedHTTPURL in config/security/securityConfig.go applies the configured pattern list and then re-checks a canonicalised form of an integer, hex or octal IPv4 host, but it never resolves the hostname and never inspects the address the HTTP client actually connects to. The client constructed in resources/resource_factories/create/create.go installs no dial-time hook, so no check occurs at connection time either. A hostname that resolves to a loopback, private or cloud-metadata address therefore satisfies the policy, and the response body is embedded in the generated site. An attacker who can supply a URL through content, for example a front-matter field or a CMS field, can make the build fetch an internal endpoint and publish the response in the static output, so the build artifact itself carries the data out.