-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Thu, 27 Aug 2026 11:11:03 +0200
Source: hugo
Architecture: source
Version: 0.165.0-1
Distribution: unstable
Urgency: medium
Maintainer: Debian Go Packaging Team <team+pkg-go@tracker.debian.org>
Changed-By: Dr. Tobias Quathamer <toddy@debian.org>
Changes:
hugo (0.165.0-1) unstable; urgency=medium
.
* New upstream version 0.165.0
- Refresh patches
- Build-Depend on golang-github-gohugoio-hashstructure-dev (>= 1.0.0)
- Build-Depend on golang-github-bep-overlayfs-dev (>= 0.11.0)
- Remove obsolete path from d/copyright
.
- CVE-2026-58402:
From 0.60.0 until 0.163.3, Hugo's default code-block renderer wrote the
Markdown code-fence language or info-string into the code
class="language-…" data-lang="…" wrapper without HTML escaping. A fence
info-string containing a quote and a script payload breaks out of the
attribute and injects a live script element. This issue is fixed in
0.163.3.
.
- CVE-2026-58403:
From v0.123.0 through v0.163.0, Hugo's virtual filesystem is designed so
that files under a mount cannot reach outside the mount tree, but a
regression caused RootMappingFs.statRoot to call Stat, which follows
symlinks, instead of Lstat, so a direct os.ReadFile "somefile" where
somefile was a symlink pointing outside the mount would return the
target's contents. This effectively let a symlink planted inside a
theme or local mount read arbitrary files reachable to the user running
hugo. This issue is fixed in v0.163.1.
.
- CVE-2026-58404:
From v0.162.0 through v0.163.0, the default security.http.urls policy
denies requests to loopback, internal, and cloud-metadata IPv4
literals, but the deny rule only matched dotted-decimal notation, so
alternate IPv4 encodings of the same addresses, including integer, hex,
or octal, passed the policy. When a template passes an untrusted or
data-derived URL to resources.GetRemote and the host platform uses the
cgo system resolver, these encodings resolve to the blocked address,
allowing build-time server-side requests to loopback and internal
services, including the cloud-metadata endpoint in hosted or CI builds;
the same check is reused on redirects, so the gap also applies to each
redirect hop. This issue is fixed in v0.163.1.
.
- CVE-2026-75926:
Hugo 0.161.0 placed the Node asset pipelines behind the Node.js
permission model so that code running through PostCSS, Babel, or
TailwindCSS could not reach the file system outside the project
directory. Hugo 0.162.0 added tailwindcss to the AllowChildProcess
default in config/security/securityConfig.go, which makes
nodePermissionArgs in common/hexec/exec.go append --allow-child-process
whenever the tool being launched is named tailwindcss. TailwindCSS loads
the site's tailwind.config.js through require at startup, so top-level
code in that file executes inside the permitted Node process and can
call child_process to spawn a shell. The spawned process is not a Node
process and inherits none of the permission flags, so it runs with the
full privileges of the account performing the build. Building a site
whose theme, module, or starter template supplies the Tailwind
configuration therefore yields arbitrary command execution rather than
the confined file access the permission model was introduced to enforce.
Hugo 0.165.0 removes tailwindcss from the default security.exec.allow
list, so the tool is no longer launched under the default configuration.
Checksums-Sha1:
9fe58a0ad130d1dd885306e95cf1b57fb3615ef0 6558 hugo_0.165.0-1.dsc
b366cbeacea9e267c5bb6ee8d848b487662e5d23 9632668 hugo_0.165.0.orig.tar.xz
b4e651c6b31fc499e58ec22502e05ace191b428d 608620 hugo_0.165.0-1.debian.tar.xz
cdcb739c241646c5c45d7670525b8b98c7a6fd6a 15846620 hugo_0.165.0-1.git.tar.xz
3ce0ab7ca90e568df7baacdaf4adefd5390d35d0 17664 hugo_0.165.0-1_source.buildinfo
Checksums-Sha256:
4940b58e695832f479bf0edde2f45363e07340ddad9cb7098a5e214f9cb8ae9e 6558 hugo_0.165.0-1.dsc
ffaa5bcdf8736cf4e7acce0c3e1d2b179553557b766d08c2dae597fdaa9638b1 9632668 hugo_0.165.0.orig.tar.xz
51c618774f38c64a8f478fa8b3478f6e53b26a4606bd3b256b3f39625156022c 608620 hugo_0.165.0-1.debian.tar.xz
b4f3a2ed9f2b2508a4eb846291c23dd4504666a74fba09d2e88c98b123c3da85 15846620 hugo_0.165.0-1.git.tar.xz
109939a5ee279ba609976963cd24996895500ca0a5f553aa63adcae2912f337a 17664 hugo_0.165.0-1_source.buildinfo
Files:
cd4f2707ae3bd94a820fd622c4840295 6558 web optional hugo_0.165.0-1.dsc
871aafff94d7a55d6812c0a7a79f8003 9632668 web optional hugo_0.165.0.orig.tar.xz
1727604ce80f1b7d748514532d954dde 608620 web optional hugo_0.165.0-1.debian.tar.xz
65c1d248c3459551e3475330dc1b2d32 15846620 web None hugo_0.165.0-1.git.tar.xz
3a911d814d21364de5b7bbedf279fcc5 17664 web optional hugo_0.165.0-1_source.buildinfo
Git-Tag-Info: tag=4aa9d6d943894297618cf4b8734a310665124ba2 fp=d1cb8f39bc5ded24c5d2c78c1302f1f036ebeb19
Git-Tag-Tagger: Dr. Tobias Quathamer <toddy@debian.org>
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEN02M5NuW6cvUwJcqYG0ITkaDwHkFAmqQASQACgkQYG0ITkaD
wHkFdxAAxz6RG4LwTNpFAZ0yGpFGVRMKvSyCqyxI0Zj42lYyFoCmNF1LCsMCvJOo
8nW8k4wYvG8qlp0n21Nske3Srz4NcqUkc6INOuNCrPbtj62ftnzj+txhZbrOqd9t
zuqS3Ru6r3yM1Z+WZBMeoKnFUqJ1OJ4IP+M7Jyf2s5WUZoDYKCIJaPnfwWgeBUaa
ihIovhutuxtnMwxkju6nSZhW4wyr9bXSoS7RP4Bd+a8PIfmE0qOPKi2qNk4go4qj
Dmqib2XsyxQ85wM69W5AihpWz6zj4I/dr6wEQ6NnPmyTJYxjYxcsSzu8r21Eh0sj
bc3YtDOY7SMdmGWtR7K5Jt+nJ8EIfPNyMFiqXvWLbTkIz2i/cPI6U+4rfPuVhVVY
zmMmYA+tio+5LhT9/vKD5RM+7b2dsaUK/7JbBC2rUtWKcwKzQIKTgSYxgz9D6AQi
iQ0om76rFokhhdB49bV+HJ5b5Su50rM0ZSTyMt8jgmM9V0kUSxGcgVrITN9du+Q0
YRz2+a2T4gQVrnAmYBJbykCrPfERpqeoCTAqDF9+1PCVVijMffhigSi0qxrKmVa/
oaWDwbxE99SvT8onSWA25ST5RNA36cXMaxA+QgEuFWVOTRf9eFxQDdio0ySb/xbN
JUhT7z3Afs9OMHbs3FQlcdzM23NN2A/twWHpG8f92bPN6v2m18M=
=58gG
-----END PGP SIGNATURE-----
