Skip to content
Threat Feed
Subscribe

Product

Hugo

2 briefs RSS
high threat

Arbitrary Command Execution in Hugo via TailwindCSS Configuration

Hugo versions 0.162.0 through 0.164.0 allowed arbitrary command execution by incorrectly including TailwindCSS in the default Node.js permission sandbox, enabling malicious configurations to spawn unprivileged shell processes.

exploited Hugo +1 ssrf supply-chain static-site-generator
2t 1c updated
high advisory

Hugo security.http.urls Bypass via Alternate IPv4 Encodings (SSRF)

A Server-Side Request Forgery (SSRF) vulnerability exists in Hugo versions 0.162.0 through 0.163.0, where the 'security.http.urls' policy designed to deny requests to loopback, internal, and cloud-metadata IPv4 literals could be bypassed as the policy only matched dotted-decimal notation, allowing alternate IPv4 encodings (integer, hex, octal) to pass, enabling build-time server-side requests to internal services and cloud-metadata endpoints when untrusted or data-derived URLs are passed to 'resources.GetRemote'.

Hugo ssrf vulnerability build-time webserver
2r 3t