The vulnerability stems from Hugo’s default security.http.urls policy, which blocks loopback, internal, and cloud‑metadata IPv4 addresses. However, the deny rule only checks for dotted‑decimal notation. Alternate numeric representations—such as integer, hex, or octal—resolve to the same internal endpoints when the host platform’s cgo system resolver is used. When an attacker supplies an untrusted or data‑derived URL to resources.GetRemote, Hugo may perform build‑time server‑side requests that reach internal or cloud‑metadata services, exposing sensitive data or enabling further attacks.

The affected product is Hugo, the static site generator developed by gohugoio. Versions from 0.162.0 through 0.163.0 inclusive are impacted. The patch that restores proper IPv4 encoding checks is available in v0.163.1 and later releases.

The CVSS score of 4.6 indicates medium severity, while the EPSS score of less than 1% suggests a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Attackers would need to provide a template or data source that, during the build process, contains a URL with an alternate IPv4 encoding and the build environment must use the cgo system resolver for the encoding to resolve to the internal target. Successful exploitation can allow the attacker to discover, exfiltrate, or otherwise manipulate internal services during the build.