Hi, The following vulnerabilities were published for hugo. CVE-2026-10582[0]: | Hugo's security.http.urls allowlist is the only control on outbound | fetches made by resources.GetRemote, and it inspects the URL text | alone. CheckAllowedHTTPURL in config/security/securityConfig.go | applies the configured pattern list and then re-checks a | canonicalised form of an integer, hex or octal IPv4 host, but it | never resolves the hostname and never inspects the address the HTTP | client actually connects to. The client constructed in | resources/resource_factories/create/create.go installs no dial-time | hook, so no check occurs at connection time either. A hostname that | resolves to a loopback, private or cloud-metadata address therefore | satisfies the policy, and the response body is embedded in the | generated site. An attacker who can supply a URL through content, | for example a front-matter field or a CMS field, can make the build | fetch an internal endpoint and publish the response in the static | output, so the build artifact itself carries the data out. CVE-2026-10618[1]: | Hugo's default fenced-code-block renderer writes attribute values | taken from the code-fence info string into the rendered HTML without | escaping them. New in markup/internal/attributes/attributes.go | converts every attribute value from a byte slice to a string as it | is stored, deliberately dropping the escaping that used to happen | there, and RenderAttributes in the same file escapes only values | that are still byte slices, so its escaping branch is never reached | and every value is written verbatim. The function's documentation | states that it performs HTML escaping of string attributes, which it | does not. A quote inside an attribute value in the info string | therefore terminates the attribute and allows a further attribute, | including an event handler, to be placed on the wrapper element, and | the script runs for every visitor who loads the page. This path is | reached under the default configuration, with code fences enabled | and without goldmark's unsafe setting or any custom render hook. | Attribute names beginning with on are filtered when the attributes | are parsed, so injection is achieved through the value rather than | the name. If you fix the vulnerabilities please also make sure to include the CVE (Common Vulnerabilities & Exposures) ids in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-10582 https://www.cve.org/CVERecord?id=CVE-2026-10582 [1] https://security-tracker.debian.org/tracker/CVE-2026-10618 https://www.cve.org/CVERecord?id=CVE-2026-10618 [2] https://github.com/gohugoio/hugo/issues/15247 Regards, Salvatore