mirror of
https://github.com/gohugoio/hugo.git
synced 2026-09-03 12:12:37 +00:00
Bjørn Erik Pedersen
d6e6f9e500
security.http.urls only inspects the URL text, so a hostname that resolves to a loopback, private or link-local address (e.g. the cloud metadata endpoint) satisfied the policy and let resources.GetRemote reach an internal endpoint, embedding the response in the built site. Install a dial-time hook on the remote-fetch transport that rejects connections to non-global-unicast or private addresses. It is enforced only under the default hardened allowlist; a user who customizes security.http.urls has opted into their own hosts, so the check stands down and local/internal fetches keep working. See CVE-2026-10582. Closes #15247. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>