25 results · Feed
-
Medium 5.4
Hugo v0.60.0 before v0.167.0 Stored XSS via Table of Contents Heading IDs
Hugo from v0.60.0 before v0.167.0 contains a stored cross-site scripting vulnerability that allows Markdown content authors to inject HTML by supplying crafted explicit heading IDs. Attackers can break out of the unescaped href attribute in .TableOfContents o…
-
Medium 5.5
Hugo from v0.162.0 before v0.167.0 Symlink File Disclosure via Nested Mount Ancestor
Hugo from v0.162.0 before v0.167.0 contains an improper link resolution vulnerability that lets malicious themes or modules expose files outside their root via nested-mount ancestor directories. Attackers controlling a theme can place a symlink or NTFS juncti…
-
Medium 5.5
Hugo v0.84.0 before v0.167.0 Path Traversal via js.Build ESBuild Resolver
Hugo from v0.84.0 before v0.167.0 contains a path traversal vulnerability that allows malicious themes or modules to read files outside the project root via ESBuild's fallback resolver in js.Build, js.Batch, and css.Build. Attackers can ship relative imports …
-
Medium 5.5
Hugo before v0.167.0 Path Traversal via css.Sass Import Fallback
Hugo before v0.167.0 contains a path traversal vulnerability in css.Sass that allows malicious themes or modules to read files outside the project root through the Sass compiler's import fallback. Attackers can ship stylesheets with relative, absolute, or sym…
-
Medium 6.1
Hugo before 0.166.0 Cross-Site Scripting via text/org
Hugo is a static site generator. In versions from v0.56.0 through v0.165.x, content files mapped to the text/org media type are rendered without escaping raw HTML: Org export blocks and @@html:...@@ snippets pass HTML through unescaped, resulting in cross-sit…
-
High 8.4
Hugo v0.162.0 before v0.166.0 IP-literal Deny Rule Bypass
Hugo versions from v0.162.0 before v0.166.0 contain a case-sensitive validation flaw in the security.http.urls IP-literal deny rule that allows attackers to bypass restrictions. Attackers can use mixed-case URL schemes in resources.GetRemote calls to fetch fr…
-
Medium 5.4
Hugo before 0.166.0 Stored XSS via lineAnchors code block option
Hugo versions 0.75.0 through 0.165.x contain a stored cross-site scripting vulnerability: the syntax highlighter does not escape the `lineAnchors` option before passing it to Chroma, which writes the value verbatim into the `id` and `href` attributes of the g…
-
High 7.5
Hugo before v0.166.0 Path Traversal via Symlinked Mount Roots
Hugo is a static site generator. In versions after v0.123.0 and before v0.166.0, Hugo's symlink confinement checks stopped at the mount root itself, so a theme or module checked into themes/ (or a vendored module) could contain a symlink at a mount root (for …
-
High 7.5
Hugo v0.161.0 to v0.165.0 Arbitrary File Read via Symlinks
Hugo versions from v0.161.0 through v0.165.0 run Node.js tools (css.PostCSS, css.TailwindCSS, js.Babel) under the Node.js permission model to restrict file system reads to the project directory and configured mounts. Because the Node.js permission model valid…
-
Critical 9.8
Hugo before v0.165.0 Insufficient Permission Restriction via TailwindCSS
Hugo is a static site generator. From v0.161.0, Hugo executes Node tools under Node's permission model, but TailwindCSS — included in the default security.exec.allow list — requires a highly permissive configuration (--allow-addons, --allow-child-process, --a…
-
Medium 6.3
Hugo before v0.165.0 Symlink Confinement Bypass via resources.Get
Hugo is a static site generator. In versions after v0.123.0 and before v0.165.0, symlinks in parent directories were not dropped during direct resource lookups, allowing path confinement to be bypassed. An attacker who can place — or who convinces a site auth…
-
Medium 5.4
Hugo 0.93.0 through 0.165.0 Stored Cross-Site Scripting via Unescaped Code-Fence Attribute Values
Hugo's default fenced-code-block renderer writes attribute values taken from the code-fence info string into the rendered HTML without escaping them. New in markup/internal/attributes/attributes.go converts every attribute value from a byte slice to a string …
-
High 7.4
Hugo 0.91.0 through 0.165.0 Server-Side Request Forgery via security.http.urls Lacking Destination Address Validation
Hugo's security.http.urls allowlist is the only control on outbound fetches made by resources.GetRemote, and it inspects the URL text alone. CheckAllowedHTTPURL in config/security/securityConfig.go applies the configured pattern list and then re-checks a cano…
-
High 8.6
Hugo 0.162.0 to 0.164.x - Node Permission Model Bypass via Default TailwindCSS Child-Process Grant
Hugo 0.161.0 placed the Node asset pipelines behind the Node.js permission model so that code running through PostCSS, Babel, or TailwindCSS could not reach the file system outside the project directory. Hugo 0.162.0 added tailwindcss to the AllowChildProcess…
-
Medium 6.9
Hugo: Symlink confinement bypass in resources.Get
Hugo is a static site generator. From 0.123.0 to 0.161.1, a regression made RootMappingFs.statRoot use Stat (follows symlinks) instead of Lstat , so a direct resources.Get of a symlink pointing outside its mount returned the target's contents — letting…
-
Medium 6.3
Hugo: security.http.urls allow-list bypass via HTTP redirects
Hugo is a static site generator. From 0.91.0 until 0.162.0, resources.GetRemote enforces security.http.urls on the URL it is called with, but it did not re-validate intermediate URLs on HTTP 3xx redirects. An allowed server (or an attacker controlling its DNS…
-
Medium 5.1
Hugo: XSS via text/html content files
Hugo is a static site generator. Prior to 0.162.0, Hugo accepts content files in several markup formats. Files mapped to the text/html media type (typically .html files under /content, or pages produced by a content adapter that sets content.mediaType = "text…
-
Medium 5.9
Hugo symlink confinement bypass in os.ReadFile
Hugo is a static site generator. From v0.123.0 through v0.163.0, Hugo's virtual filesystem is designed so that files under a mount cannot reach outside the mount tree, but a regression caused RootMappingFs.statRoot to call Stat, which follows symlinks, instea…
-
Medium 5.1
Hugo default code block renderer XSS via unescaped code-fence language
Hugo is a static site generator. From 0.60.0 until 0.163.3, Hugo's default code-block renderer wrote the Markdown code-fence language or info-string into the code class="language-…" data-lang="…" wrapper without HTML escaping. A fence info-string containing a…
-
Medium 4.6
Hugo security.http.urls deny rules bypassed by alternate IPv4 encodings
Hugo is a static site generator. From v0.162.0 through v0.163.0, the default security.http.urls policy denies requests to loopback, internal, and cloud-metadata IPv4 literals, but the deny rule only matched dotted-decimal notation, so alternate IPv4 encodings…
-
Medium 6.2
Hugo: Node tool execution allows file system access outside the project directory
Hugo is a static site generator. From 0.43 to before 0.161.0, when building a Hugo site that uses Node-based asset pipelines (PostCSS, Babel, TailwindCSS), Hugo invoked the configured Node tools without restrictions on file system access. As a result, executi…
-
Medium 5.3
Hugo does not properly escape some Markdown links
Hugo is a static site generator. From 0.60.0 to before 0.159.2, links and image links in the default markdown to HTML renderer are not properly escaped. Hugo users who trust their Markdown content or have custom render hooks for links and images are not affec…
-
Medium 5.3
Hugo does not escape some attributes in internal templates
Hugo is a static site generator. Starting in version 0.123.0 and prior to version 0.139.4, some HTML attributes in Markdown in the internal templates listed below not escaped in internal render hooks. Those whoa re impacted are Hugo users who do not trust the…
-
Medium 6.1
Hugo doesn't escape markdown title in internal render hooks
Hugo is a static site generator. Starting in version 0.123.0 and prior to version 0.125.3, title arguments in Markdown for links and images not escaped in internal render hooks. Hugo users who are impacted are those who have these hooks enabled and do not tru…
-
High 7.7
Hugo can execute a binary from the current directory on Windows
Hugo is a fast and Flexible Static Site Generator built in Go. Hugo depends on Go's `os/exec` for certain features, e.g. for rendering of Pandoc documents if these binaries are found in the system `%PATH%` on Windows. In Hugo before version 0.79.1, if a malic…