PT-2020-16403 · Go · Hugo

Dholmesdell · Published 2020-12-21 · Updated 2021-06-23 · CVE-2020-26284

Positive Technologies (AI Summary)

CVSS v3.1

8.5

High

Base vector

AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Hugo versions prior to 0.79.1

Description Hugo is a fast and Flexible Static Site Generator built in Go. It depends on Go's os/exec for certain features, such as rendering of Pandoc documents if these binaries are found in the system %PATH% on Windows. If a malicious file with the same name (exe or bat) is found in the current working directory at the time of running hugo, the malicious command will be invoked instead of the system one. Windows users who run hugo inside untrusted Hugo sites are affected.

Recommendations For Hugo versions prior to 0.79.1, upgrade to Hugo v0.79.1 to resolve the issue. As a temporary workaround, consider avoiding untrusted Hugo sites until the issue is resolved.

Exploit

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2020-26284

GHSA-8J34-9876-PVFQ

Affected Products

Hugo

References · 8

• 🔥 https://github.com/golang/go/issues/38736 · Exploit
• https://github.com/gohugoio/hugo/security/advisories/GHSA-8j34-9876-pvfq · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2020-26284 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2020-26284 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2020-26284 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-8j34-9876-pvfq · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-26284 · Vendor Advisory
• https://t.me/cvenotify/7515 · Telegram Post