Threats tagged 'ghsa-xpjr-56xg-vx6v'

Hugo versions from 0.162.0 up to but not including 0.166.0 have a case-sensitive validation flaw in the security.http.urls IP-literal deny rule. This flaw allows attackers to bypass restrictions by using mixed-case URL schemes in resources.GetRemote calls, enabling fetching from restricted IP addresses such as localhost.