Executive brief
Hugo is a static site generator that runs Node.js tools like PostCSS for processing stylesheets. Versions 0.161.0 through 0.165.0 fail to detect symbolic links that escape the intended sandbox, allowing an attacker who can commit files to a project to read arbitrary files from the build system and potentially publish them. An attacker only needs to contribute a symlink pointing to sensitive files like configuration or secrets, paired with a Node.js plugin that reads it.
Technical details
The vulnerability is improper link resolution in the Node.js permission model sandbox. Hugo restricts file system access lexically but fails to follow symlinks that point outside allowed paths, violating the intended sandbox boundary. An attacker with commit access (via pull request or direct contribution) can craft a symlink like assets/css/x.css → /etc/passwd and execute a PostCSS plugin to read it, disclosing arbitrary files. The fix in v0.166.0 scans allowed paths before invoking Node.js tools and fails the build if symlinks resolve outside the sandbox.
Affected products
- gohugoio Hugo v0.161.0 through v0.165.0
Timeline
- 2026-09-26: disclosed: Published on NVD and GitHub Security Advisory
- 2026-09-26: patched: Fixed in v0.166.0