CyberRota Analysis
AI-GeneratedVersions of Hugo from v0.162.0 to v0.163.0 are vulnerable due to a flaw in the security policy that inadequately blocks alternate IPv4 encodings, allowing unauthorized access to loopback and internal services during build-time server-side requests. This vulnerability can lead to exposure of sensitive internal resources, particularly in hosted or CI environments. Users of affected Hugo versions should prioritize upgrading to v0.163.1 to mitigate potential security risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Hugo is a static site generator. From v0.162.0 through v0.163.0, the default security.http.urls policy denies requests to loopback, internal, and cloud-metadata IPv4 literals, but the deny rule only matched dotted-decimal notation, so alternate IPv4 encodings of the same addresses, including integer, hex, or octal, passed the policy. When a template passes an untrusted or data-derived URL to resources.GetRemote and the host platform uses the cgo system resolver, these encodings resolve to the blocked address, allowing build-time server-side requests to loopback and internal services, including the cloud-metadata endpoint in hosted or CI builds; the same check is reused on redirects, so the gap also applies to each redirect hop. This issue is fixed in v0.163.1.
Related CVEs
Other vulnerabilities affecting the same vendor(s)