Hugo can execute a binary from the current directory on Windows

Root

Cause

Hugo uses Go's os/exec package to invoke external programs like Pandoc. On Windows, Go's LookPath function searches the current working directory before checking the system PATH environment variable [2]. This behavior allows a malicious executable or batch file placed in the same directory as the Hugo project to be executed instead of the system command [1].

Exploitation

An attacker can create a malicious file with the same name as a tool Hugo relies on (e.g., pandoc.exe) and place it in the root of a Hugo site. When a user runs hugo in that directory, the malicious file is executed with the user's privileges [3]. No authentication is required, and the attack is local to the user's machine.

Impact

Successful exploitation leads to arbitrary command execution on the affected Windows system. The attacker gains the same rights as the logged-in user, potentially leading to data theft, malware installation, or further compromise [1].

Mitigation

Users should upgrade to Hugo v0.79.1, which addresses this issue by using an updated os/exec that avoids the current directory lookup [3]. There is no workaround other than avoiding untrusted Hugo sites.