# CVE-2026-100690: Hugo arbitrary file read via symlinks in Node.js tools

Source: https://junglewise.ai/threats/cve-2026-100690-hugo-versions-from-v0-161-0-through-v0-165-0-run-node-js-tools  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-26. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-100690 · Severity: high · CVSS 7.5 · Published 2026-09-26

Hugo is a static site generator that runs Node.js tools like PostCSS for processing stylesheets. Versions 0.161.0 through 0.165.0 fail to detect symbolic links that escape the intended sandbox, allowing an attacker who can commit files to a project to read arbitrary files from the build system and potentially publish them. An attacker only needs to contribute a symlink pointing to sensitive files like configuration or secrets, paired with a Node.js plugin that reads it.

Technologies: [Gohugoio Hugo](https://junglewise.ai/threats/technologies/gohugoio-hugo). Vendors: [Gohugoio](https://junglewise.ai/threats/vendors/gohugoio).

## Quick answers

**Is CVE-2026-100690 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-100690 being exploited in the wild.

**How severe is CVE-2026-100690?** High severity, with a CVSS score of 7.5, published 26 September 2026.

**Which products and versions are affected?** Gohugoio Hugo v0.161.0 through v0.165.0.

**Is there a fix for CVE-2026-100690?** A patch was published on 2026-09-26: Fixed in v0.166.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-100690 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-100690?** Check whether you run Gohugoio Hugo at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is improper link resolution in the Node.js permission model sandbox. Hugo restricts file system access lexically but fails to follow symlinks that point outside allowed paths, violating the intended sandbox boundary. An attacker with commit access (via pull request or direct contribution) can craft a symlink like assets/css/x.css → /etc/passwd and execute a PostCSS plugin to read it, disclosing arbitrary files. The fix in v0.166.0 scans allowed paths before invoking Node.js tools and fails the build if symlinks resolve outside the sandbox.

## Affected products

- gohugoio Hugo v0.161.0 through v0.165.0

## Timeline

- 2026-09-26: disclosed: Published on NVD and GitHub Security Advisory
- 2026-09-26: patched: Fixed in v0.166.0

## References

- [https://github.com/gohugoio/hugo/security/advisories/GHSA-x3mx-cm49-8m9c](https://github.com/gohugoio/hugo/security/advisories/GHSA-x3mx-cm49-8m9c)
- [https://www.vulncheck.com/advisories/hugo-0.161.0-to-0.165.0-arbitrary-file-read-via-symlinks](https://www.vulncheck.com/advisories/hugo-0.161.0-to-0.165.0-arbitrary-file-read-via-symlinks)

## Related threats

- [Hugo stored cross-site scripting in Table of Contents heading IDs](https://junglewise.ai/threats/cve-2026-109597-hugo-from-v0-60-0-before-v0-167-0-contains-a-stored-cross-site)
- [Hugo cross-site scripting via text/org content files](https://junglewise.ai/threats/cve-2026-100694-hugo-is-a-static-site-generator-in-versions-from-v0-56-0-through)
- [Hugo case-sensitive URL scheme validation bypass in security.http.urls](https://junglewise.ai/threats/cve-2026-100693-hugo-versions-from-v0-162-0-before-v0-166-0-contain-a-case)
- [Hugo symlink confinement bypass in mount roots](https://junglewise.ai/threats/cve-2026-100692-hugo-is-a-static-site-generator-in-versions-after-v0-123-0-and)