Advisory · CVE-2026-100690
Hugo Node.js sandbox misses symlinks, exposing build-machine files
Hugo v0.161.0 through v0.165.0 runs Node.js tools (PostCSS, TailwindCSS, Babel) under the Node.js permission model to restrict file reads to the project directory, but the model validates only the lexical path and follows symlinks pointing outside the allowed set. A contributor can commit a symlink such as assets/css/x.css pointing at a sensitive file plus a PostCSS plugin that reads it, disclosing any file the Hugo build process can read, potentially embedded in the published site. Fixed in v0.166.0, which fails the build when a symlink resolves outside the allowed paths.
- Vendor
- Hugo
- Product
- Hugo
- Identifier / CWE
- CVE-2026-100690
CWE-59 - Action timing
- Immediate
Explain it like I’m five
The build room is locked so workers can only read papers inside it. But a worker brings a folder that is secretly a tunnel to the filing cabinet outside, and the guard checks only the folder's name, not where the tunnel leads.
- 01Malicious symlink
A contributor commits a symlink inside the project pointing outside it, such as assets/css/x.css to a sensitive file.
- 02Lexical check
The Node.js permission model validates the symlink path text, not its resolved target.
- 03Read during build
A PostCSS plugin (or similar Node.js tool) reads the symlinked file during the Hugo build.
- 04Disclosure
The file contents are disclosed and can be embedded into the published site.
What happened
Hugo v0.161.0 through v0.165.0 runs Node.js tools (PostCSS, TailwindCSS, Babel) under the Node.js permission model to restrict file reads to the project directory, but the model validates only the lexical path and follows symlinks pointing outside the allowed set (CVE-2026-100690, CVSS 8.7). A contributor can commit a symlink such as assets/css/x.css pointing at a sensitive file, together with a PostCSS plugin that reads it, disclosing any file the Hugo build process can read and potentially embedding it in the published site. Fixed in Hugo v0.166.0, which fails the build when a symlink resolves outside the allowed paths.
What to do
- Upgrade Hugo to v0.166.0 or later.
- Audit commits for symlinks in contributor-controlled content, especially under assets and theme directories.
- Review published site output for unexpected content that could embed build-machine files.
- Rotate secrets that the build environment could read during the exposure window.
Management note
Build pipelines run with the keys to the kingdom, and symlinks are the classic way to smuggle files past path checks. If you accept community themes or contributor PRs into Hugo builds, this one is worth the audit, not just the upgrade.