Quick answers
- Is CVE-2026-109574 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-109574 being exploited in the wild.
- How severe is CVE-2026-109574?
- Medium severity, with a CVSS score of 5.5, published 12 October 2026.
- Which products and versions are affected?
- Hugo before v0.167.0.
- Is there a fix for CVE-2026-109574?
- Yes: fixed in v0.167.0. Until then: Do not use themes or modules from untrusted sources. Review @import and @use statements in Sass entry points for paths that reference locations outside the project directory. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-109574 attacked?
- It is attacked with local access, in a web application.
- Am I affected by CVE-2026-109574?
- Check whether you run Hugo at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- Fixed in: v0.167.0
Do not use themes or modules from untrusted sources. Review @import and @use statements in Sass entry points for paths that reference locations outside the project directory.
Technical details
The css.Sass component resolves @import and @use directives not found in Hugo's virtual file system by passing them to the underlying Sass compiler (Dart Sass or LibSASS) with the real filesystem as include paths. The compiler does not respect Hugo's project root boundary and follows symlinks, allowing a malicious theme to traverse outside the project directory via relative paths like @import "../../../../secret" or absolute/symlinked imports. An attacker controlling a theme or module can read any file accessible to the build process and publish the contents as CSS.
Affected products
- Hugo Hugo before v0.167.0
Timeline
- 2026-09-28: disclosed
- 2026-09-28: patched