hugo-jupyter (>=0.2.1, <=0.3.0) potentially affected by CVE-2022-24758 via notebook (5.0.0)

notebook PYPI version 5.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on notebook and may be impacted: - hugo-jupyter =0.2.1, =0.3.0 Source cves: CVE-2022-24758 Source advisory: OSV:PYSEC-2022-180...

GHSA-8J34-9876-PVFQ Hugo can execute a binary from the current directory on Windows

Impact Hugo depends on Go's os/exec for certain features, e.g. for rendering of Pandoc documents if these binaries are found in the system %PATH% on Windows. However, if a malicious file with the same name exe or bat is found in the current working directory at the time of running hugo, the...

Hugo can execute a binary from the current directory on Windows

Impact Hugo depends on Go's os/exec for certain features, e.g. for rendering of Pandoc documents if these binaries are found in the system %PATH% on Windows. However, if a malicious file with the same name exe or bat is found in the current working directory at the time of running hugo, the...

HugoMario swagger-codegen security vulnerabilities

HugoMario swagger-codegen is an application from HugoMario. It is used to automatically generate API client libraries generate SDKs, server stubs and documentation given an OpenAPI Spec. A security vulnerability exists in swagger-codegen, which can be exploited by an attacker to append the conten...

hugo-jupyter (>=0.2.1, <=0.3.0) potentially affected by CVE-2021-23980 via bleach (2.0.0)

bleach PYPI version 2.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on bleach and may be impacted: - hugo-jupyter =0.2.1, =0.3.0 Source cves: CVE-2021-23980 Source advisory: OSV:GHSA-VV2X-VRPJ-QQPQ...

hugo-jupyter (>=0.2.1, <=0.3.0) potentially affected by CVE-2021-23980 via bleach (2.0.0)

bleach PYPI version 2.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on bleach and may be impacted: - hugo-jupyter =0.2.1, =0.3.0 Source cves: CVE-2021-23980 Source advisory: OSV:PYSEC-2021-865...

hugo-jupyter (>=0.2.1, <=0.3.0) potentially affected by CVE-2020-25659 via cryptography (2.0.0)

cryptography PYPI version 2.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on cryptography and may be impacted: - hugo-jupyter =0.2.1, =0.3.0 Source cves: CVE-2020-25659 Source advisory: OSV:PYSEC-2021-62...

Malicious Code Execution

Hugo is vulnerable to malicious code execution. If a malicious file with the same name exe or bat is found in the current working directory at the time of running hugo, the malicious command will be invoked instead of the system one. Windows users who run hugo inside untrusted Hugo sites are...

CVE-2020-26284

Hugo is a fast and Flexible Static Site Generator built in Go. Hugo depends on Go's os/exec for certain features, e.g. for rendering of Pandoc documents if these binaries are found in the system %PATH% on Windows. In Hugo before version 0.79.1, if a malicious file with the same name exe or bat is...

DEBIAN-CVE-2020-26284

Hugo is a fast and Flexible Static Site Generator built in Go. Hugo depends on Go's os/exec for certain features, e.g. for rendering of Pandoc documents if these binaries are found in the system %PATH% on Windows. In Hugo before version 0.79.1, if a malicious file with the same name exe or bat is...

CVE-2020-26284

Hugo is a fast and Flexible Static Site Generator built in Go. Hugo depends on Go's os/exec for certain features, e.g. for rendering of Pandoc documents if these binaries are found in the system %PATH% on Windows. In Hugo before version 0.79.1, if a malicious file with the same name exe or bat is...

Design/Logic Flaw

Hugo is a fast and Flexible Static Site Generator built in Go. Hugo depends on Go's os/exec for certain features, e.g. for rendering of Pandoc documents if these binaries are found in the system %PATH% on Windows. In Hugo before version 0.79.1, if a malicious file with the same name exe or bat is...

CVE-2020-26284

Hugo is a fast and Flexible Static Site Generator built in Go. Hugo depends on Go's os/exec for certain features, e.g. for rendering of Pandoc documents if these binaries are found in the system %PATH% on Windows. In Hugo before version 0.79.1, if a malicious file with the same name exe or bat is...

CVE-2020-26284 Hugo can execute a binary from the current directory on Windows

Hugo is a fast and Flexible Static Site Generator built in Go. Hugo depends on Go's os/exec for certain features, e.g. for rendering of Pandoc documents if these binaries are found in the system %PATH% on Windows. In Hugo before version 0.79.1, if a malicious file with the same name exe or bat is...

CVE-2020-26284

Hugo is a fast and Flexible Static Site Generator built in Go. Hugo depends on Go's os/exec for certain features, e.g. for rendering of Pandoc documents if these binaries are found in the system %PATH% on Windows. In Hugo before version 0.79.1, if a malicious file with the same name exe or bat is...

CVE-2020-26284

Hugo is a fast and Flexible Static Site Generator built in Go. Hugo depends on Go's os/exec for certain features, e.g. for rendering of Pandoc documents if these binaries are found in the system %PATH% on Windows. In Hugo before version 0.79.1, if a malicious file with the same name exe or bat is...

CVE-2020-26284

CVE-2020-26284 affects Hugo (Go-based SSG) where, before v0.79.1, Hugo uses Go’s os/exec and will invoke a malicious executable if a file named after a common Windows binary (exe or bat) exists in the current working directory when Hugo runs. This can allow an attacker to execute arbitrary code o...

CVE-2020-26284: Improper Neutralization of Special Elements used in an OS Command

Hugo is a fast and Flexible Static Site Generator built in Go. Hugo depends on Go's os/exec for certain features, e.g. for rendering of Pandoc documents if these binaries are found in the system %PATH% on Windows. In Hugo before version 0.79.1, if a malicious file with the same name exe or bat is...

PT-2020-16403

Name of the Vulnerable Software and Affected Versions Hugo versions prior to 0.79.1 Description Hugo is a fast and Flexible Static Site Generator built in Go. It depends on Go's os/exec for certain features, such as rendering of Pandoc documents if these binaries are found in the system %PATH% on...

Gohugoio Hugo Operating System Command Injection Vulnerability

Gohugoio Hugo is a framework from the Gohugoio community based on the Go language for rapid generation of static sites. An operating system command injection vulnerability exists in Hugo versions prior to 0.79.1, which stems from the fact that if a malicious file exe or bat of the same name is...