← Back to the live CVE advisory feed

CVE-2026-100690: hugo

Severity

8.7 (HIGH)

Vendor

GOHUGOIO

Affected versions

0.161.0 through before 0.166.0

Fixed version

0.166.0

Patch status

Patched

Published

2026-09-26T14:16:53.560

Modified

2026-09-26T14:16:53.560

Why it matters

This matters because the affected product may be exposed on public websites. A vulnerable plugin can create a direct path to site compromise, malicious code deployment, or data theft.

Recommended admin actions

• Review and patch based on exposure, asset criticality, and business impact.
• Check whether the affected WordPress plugin or theme is installed.
• Update, disable, or remove the affected component if present.
• Compare installed versions against the affected version range in the advisory.

Technical summary

Hugo versions from v0.161.0 through v0.165.0 run Node.js tools (css.PostCSS, css.TailwindCSS, js.Babel) under the Node.js permission model to restrict file system reads to the project directory and configured mounts. Because the Node.js permission model validates only the lexical path and follows symbolic links that point outside the allowed set, Hugo did not detect symlinks escaping the sandbox. An attacker who can contribute content to a Hugo project (for example via a pull request) can commit a symlink such as assets/css/x.css -> /etc/passwd together with a PostCSS plugin that reads it, allowing any file readable by the Hugo build process to be disclosed and potentially embedded in the published site. This affects builds using the default security configuration; projects that do not invoke Node.js tools are unaffected. Fixed in v0.166.0, which scans allowed paths and fails the build when a symbolic link resolves outside them.

View the official NVD record for CVE-2026-100690

CVE data is sourced from NVD/CNA records and optional enrichment. Validate against the vendor advisory before taking production action.