Hugo’s security.http.urls allowlist is the sole gatekeeper for outbound fetches performed by resources.GetRemote, and its validation examines only the textual form of the URL. The code checks the URL against a list of patterns and then inspects a canonicalized integer, hex or octal IPv4 representation, but it never performs DNS resolution or verifies the actual address the HTTP client will reach. Consequently, a hostname that resolves to a loopback, private or cloud‑metadata address passes the allowlist check. An attacker who can supply a URL through content elements, such as a front‑matter field or a CMS entry, can instruct the Hugo build to fetch data from an internal service and embed that response body directly into the generated static site. The build artifact itself then leaks sensitive internal data to anyone who can download the output, representing a significant confidentiality breach.

The flaw is present in Hugo versions 0.91.0 through 0.165.0, the only affected product listed by the CNA. Users relying on these releases for site generation are susceptible.

The CVSS score of 8.3 classifies this vulnerability as high severity. The EPSS score is unavailable and the vulnerability is not currently listed in CISA’s KEV catalog, but the lack of destination address validation makes exploitation likely in environments where content authors can inject URLs. Attackers need only control the build content to trigger the remote request; no additional privileges are required. The potential impact is the unauthorized disclosure of internal endpoints or metadata via the static build output.