CVE-2026-100690: Gohugo Hugo Information Disclosure Flaw

CVE-2026-100690 Overview

CVE-2026-100690 is an arbitrary file read vulnerability in the Hugo static site generator affecting versions v0.161.0 through v0.165.0. Hugo invokes Node.js tooling (css.PostCSS, css.TailwindCSS, js.Babel) under the Node.js permission model to restrict file reads to the project directory and configured mounts. The permission model validates only lexical paths and follows symbolic links outside the allowed set. An attacker who can contribute content to a Hugo project can commit a symlink pointing to a sensitive file along with a PostCSS plugin that reads it, exposing any file readable by the build process. The issue is fixed in v0.166.0 [CWE-59].

Critical Impact

Attackers with content-contribution access (such as pull requests) can exfiltrate arbitrary files readable by the Hugo build process, including secrets and credentials.

Affected Products

• Hugo v0.161.0 through v0.165.0
• Projects using default security configuration with Node.js tooling (css.PostCSS, css.TailwindCSS, js.Babel)
• CI/CD pipelines that build Hugo sites from untrusted contributions

Discovery Timeline

• 2026-09-26 - CVE-2026-100690 published to NVD
• 2026-09-30 - Last updated in NVD database

Technical Details for CVE-2026-100690

Vulnerability Analysis

Hugo delegates CSS and JavaScript transformations to Node.js tools and relies on the Node.js permission model (--allow-fs-read) to constrain file access to project directories and declared mounts. The permission model performs lexical path validation only. It does not resolve symbolic links before comparing paths against the allowed set.

This gap allows a symlink stored inside the project tree to transparently reference files anywhere on the build host. When a PostCSS, Tailwind, or Babel plugin reads the symlink target, Node.js honors the symlink and returns the external file content. The disclosed content can be embedded into generated CSS, JavaScript, or HTML artifacts and published with the site.

Projects that do not invoke Node.js build tools are not affected. The flaw is categorized as a Link Following issue [CWE-59].

Root Cause

The root cause is incomplete sandbox enforcement. Hugo trusted the Node.js permission model to contain file reads but did not independently resolve symbolic links against the allowed path set. The permission model follows symlinks by design once the lexical path check passes, breaking the containment guarantee that Hugo assumed.

Attack Vector

An attacker submits a pull request or commit containing two artifacts. The first is a symbolic link inside the project assets, for example assets/css/x.css -> /etc/passwd. The second is a PostCSS plugin configuration that reads x.css during the build. When maintainers or CI build the site, Node.js resolves the symlink, reads the target file, and the plugin can emit its contents into the published output.

The vulnerability is network-reachable because exploitation only requires contributing content to a repository that is subsequently built by a vulnerable Hugo version.

Detection Methods for CVE-2026-100690

Indicators of Compromise

• Symbolic links in repository paths such as assets/, content/, or static/ whose targets resolve outside the project root
• Unexpected PostCSS, Tailwind, or Babel plugin additions in package.json or Hugo configuration from untrusted contributors
• Build logs showing Node.js file reads referencing paths like /etc/, /root/, or CI secret mount directories
• Published site artifacts containing fragments of system files, environment data, or credentials

Detection Strategies

• Scan repositories for symlinks using find . -type l -exec readlink -f {} \; and alert when targets escape the project root
• Audit Hugo project configurations for inclusion of css.PostCSS, css.TailwindCSS, or js.Babel pipelines combined with contributor-sourced plugins
• Enforce code review gates on changes to build scripts, Node.js dependencies, and asset directories

Monitoring Recommendations

• Monitor CI/CD runners for Hugo processes reading files outside the workspace directory
• Capture and review build output artifacts for leaked secrets prior to deployment
• Alert on new or modified symbolic links introduced via pull requests in static site repositories

How to Mitigate CVE-2026-100690

Immediate Actions Required

• Upgrade Hugo to v0.166.0 or later on all developer workstations and CI/CD build agents
• Audit recent pull requests to vulnerable Hugo projects for symlink additions and suspicious plugin changes
• Rotate any credentials, tokens, or secrets accessible to the Hugo build process if untrusted contributions were built

Patch Information

Hugo v0.166.0 resolves the vulnerability by scanning allowed paths and failing the build when a symbolic link resolves outside them. Details are available in the GitHub Security Advisory GHSA-x3mx-cm49-8m9c and the VulnCheck Advisory on Hugo.

Workarounds

• Disable css.PostCSS, css.TailwindCSS, and js.Babel pipelines until upgrading if the project can tolerate removing Node.js tooling
• Build untrusted branches and pull requests inside ephemeral, least-privilege containers with no access to host secrets
• Reject contributions that add symbolic links to the repository via pre-commit hooks or CI policy checks

# Example pre-build check to reject symlinks escaping the project root
find . -type l | while read link; do
  target=$(readlink -f "$link")
  case "$target" in
    "$PWD"/*) ;;
    *) echo "Symlink escape detected: $link -> $target"; exit 1 ;;
  esac
done