Hugo versions 0.162.0 through 0.163.0 have an SSRF vulnerability due to incomplete enforcement of the security.http.urls policy. The deny rule blocks requests to certain IP ranges only when expressed in dotted-decimal format, but alternate IPv4 encodings (integer, hex, octal) bypass this check. When a template uses untrusted or data-derived URLs with resources.GetRemote on platforms using the cgo resolver, these alternate encodings resolve to blocked addresses, enabling SSRF to loopback, internal, and cloud-metadata endpoints during site builds. The vulnerability also applies to each redirect hop. This issue is resolved in version 0.163.1.

An attacker able to influence URLs passed to resources.GetRemote can cause the Hugo build process to make unauthorized requests to internal network services, including cloud metadata endpoints, potentially exposing sensitive information or enabling further attacks within the build environment. The vulnerability is limited to affected versions and requires the host platform to use the cgo system resolver. The CVSS 4.6 score indicates a medium severity impact with partial attack complexity and some privileges required.

Upgrade to Hugo version 0.163.1 or later, where this SSRF vulnerability is fixed. Until then, avoid passing untrusted or data-derived URLs to resources.GetRemote, especially on platforms using the cgo resolver. Patch status is not explicitly stated as 'official-fix' in the data, but the description confirms the issue is fixed in v0.163.1. Therefore, applying this update is the recommended remediation.