CVE-2020-26284
Description
Hugo is a fast and Flexible Static Site Generator built in Go. Hugo depends on Go's `os/exec` for certain features, e.g. for rendering of Pandoc documents if these binaries are found in the system `%PATH%` on Windows. In Hugo before version 0.79.1, if a malicious file with the same name (`exe` or `bat`) is found in the current working directory at the time of running `hugo`, the malicious command will be invoked instead of the system one. Windows users who run `hugo` inside untrusted Hugo sites are affected. Users should upgrade to Hugo v0.79.1. Other than avoiding untrusted Hugo sites, there is no workaround.
How to fix
- gohugo hugo0.79.1 or later
- github.com/gohugoio/hugo0.79.1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| gohugo hugo | v < 0.79.1 | 0.79.1 |
| github.com/gohugoio/hugoGo | v < 0.79.1 | 0.79.1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.