Описание
Hugo is a static site generator. From 0.43 to before 0.161.0, when building a Hugo site that uses Node-based asset pipelines (PostCSS, Babel, TailwindCSS), Hugo invoked the configured Node tools without restrictions on file system access. As a result, executing hugo against an untrusted site could allow code running through these tools to read or write files outside the project's working directory. Users who do not use PostCSS, Babel, or TailwindCSS, or who only build trusted sites, are not affected. This vulnerability is fixed in 0.161.0.
A flaw was found in Hugo. When building a Hugo site that uses Node-based asset pipelines (such as PostCSS, Babel, or TailwindCSS), Hugo invoked the configured Node tools without restrictions on file system access. This could allow code running through these tools to read or write files outside the project's working directory when executing Hugo against an untrusted site.
Отчет
A flaw was found in Hugo when building sites configured with Node-based asset pipelines such as PostCSS, Babel, or TailwindCSS. Hugo invokes these external tools without enforcing directory confinement or file system access restrictions. By tricking a user or automated build pipeline into compiling an untrusted repository containing malicious pipeline configurations, an attacker can read or write arbitrary files outside the project root directory within the context of the user running Hugo.
Меры по смягчению последствий
Avoid building untrusted Hugo sites, or disable Node-based asset pipelines such as PostCSS, Babel, and TailwindCSS in site configurations. When processing unverified repositories, execute Hugo builds within an isolated, unprivileged container environment.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 10 | grafana | Not affected | ||
| Red Hat Hardened Images | grafana12.4 | Not affected | ||
| Red Hat Hardened Images | grafana13.1 | Not affected | ||
| Red Hat Hardened Images | grafana13.2 | Not affected | ||
| Red Hat OpenShift GitOps | openshift-gitops-1/argocd-rhel9 | Not affected | ||
| Red Hat OpenStack Platform 18.0 | rhoso-operators/openstack-operator-bundle | Not affected | ||
| Red Hat Hardened Images | hugo-main-0.166.0-0.1.hum1 | Fixed | RHSA-2026:66266 | 09.09.2026 |
Показывать по
Дополнительная информация
Статус:
EPSS
7.3 High
CVSS3
Связанные уязвимости
Hugo is a static site generator. From 0.43 to before 0.161.0, when building a Hugo site that uses Node-based asset pipelines (PostCSS, Babel, TailwindCSS), Hugo invoked the configured Node tools without restrictions on file system access. As a result, executing hugo against an untrusted site could allow code running through these tools to read or write files outside the project's working directory. Users who do not use PostCSS, Babel, or TailwindCSS, or who only build trusted sites, are not affected. This vulnerability is fixed in 0.161.0.
Hugo is a static site generator. From 0.43 to before 0.161.0, when building a Hugo site that uses Node-based asset pipelines (PostCSS, Babel, TailwindCSS), Hugo invoked the configured Node tools without restrictions on file system access. As a result, executing hugo against an untrusted site could allow code running through these tools to read or write files outside the project's working directory. Users who do not use PostCSS, Babel, or TailwindCSS, or who only build trusted sites, are not affected. This vulnerability is fixed in 0.161.0.
Hugo is a static site generator. From 0.43 to before 0.161.0, when bui ...
Hugo's Node tool execution allows file system access outside the project directory
ALT-PU-2026-8450: package `hugo` update to version 0.162.0-alt1
EPSS
7.3 High
CVSS3