CVE-2026-100690: Symlink Traversal Vulnerability in Hugo Node.js Integration

Hugo versions 0.161.0 through v0.165.0 are affected by a directory traversal vulnerability that stems from improper validation of symbolic links within the integrated Node.js sandbox. Hugo utilizes the Node.js permission model to restrict file system access for integrated tools such as PostCSS, TailwindCSS, and Babel. However, because the permission model validates lexical paths rather than resolved paths, Hugo fails to detect when symbolic links point outside of the project directory or configured mounts. An attacker with the ability to influence project content, such as through a malicious pull request or compromised source repository, can commit a symbolic link that resolves to a sensitive system file (e.g., /etc/passwd). When the project is built, the integrated Node.js tools follow this symlink, potentially disclosing the content of the target file in the resulting site output. This vulnerability is fixed in version v0.166.0, which enforces strict resolution of all paths to ensure they remain within allowed boundaries.

Impact

Successful exploitation allows for the disclosure of arbitrary files readable by the user account running the Hugo build process. This is particularly critical in CI/CD environments where build processes may have broader read permissions or access to sensitive build-time secrets and environment files. The number of impacted projects depends on the use of Node.js-based Hugo features (PostCSS, TailwindCSS, Babel) and the presence of external contributor access.

Recommendation

Prioritize the upgrade of all Hugo instances to version v0.166.0 or later to address the symlink resolution logic. For organizations using Hugo in automated pipelines, implement strict file system auditing to detect non-project-relative symbolic links in source repositories prior to the build phase.