#1146720 hugo: CVE-2026-10582 CVE-2026-10618

Package:
src:hugo
Source:
src:hugo
Submitter:
Salvatore Bonaccorso
Date:
2026-09-04 18:59:02 UTC
Severity:
normal
Tags:
#1146720#5
Date:
2026-09-04 18:57:30 UTC
From:
To:
Hi,

The following vulnerabilities were published for hugo.

CVE-2026-10582[0]:
| Hugo's security.http.urls allowlist is the only control on outbound
| fetches made by resources.GetRemote, and it inspects the URL text
| alone. CheckAllowedHTTPURL in config/security/securityConfig.go
| applies the configured pattern list and then re-checks a
| canonicalised form of an integer, hex or octal IPv4 host, but it
| never resolves the hostname and never inspects the address the HTTP
| client actually connects to. The client constructed in
| resources/resource_factories/create/create.go installs no dial-time
| hook, so no check occurs at connection time either. A hostname that
| resolves to a loopback, private or cloud-metadata address therefore
| satisfies the policy, and the response body is embedded in the
| generated site. An attacker who can supply a URL through content,
| for example a front-matter field or a CMS field, can make the build
| fetch an internal endpoint and publish the response in the static
| output, so the build artifact itself carries the data out.


CVE-2026-10618[1]:
| Hugo's default fenced-code-block renderer writes attribute values
| taken from the code-fence info string into the rendered HTML without
| escaping them. New in markup/internal/attributes/attributes.go
| converts every attribute value from a byte slice to a string as it
| is stored, deliberately dropping the escaping that used to happen
| there, and RenderAttributes in the same file escapes only values
| that are still byte slices, so its escaping branch is never reached
| and every value is written verbatim. The function's documentation
| states that it performs HTML escaping of string attributes, which it
| does not. A quote inside an attribute value in the info string
| therefore terminates the attribute and allows a further attribute,
| including an event handler, to be placed on the wrapper element, and
| the script runs for every visitor who loads the page. This path is
| reached under the default configuration, with code fences enabled
| and without goldmark's unsafe setting or any custom render hook.
| Attribute names beginning with on are filtered when the attributes
| are parsed, so injection is achieved through the value rather than
| the name.


If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-10582
https://www.cve.org/CVERecord?id=CVE-2026-10582
[1] https://security-tracker.debian.org/tracker/CVE-2026-10618
https://www.cve.org/CVERecord?id=CVE-2026-10618
[2] https://github.com/gohugoio/hugo/issues/15247

Regards,
Salvatore