hugo: Hugo: Arbitrary file read/write via unrestricted file system access in Node-based asset pipelines (CVE-2026-44301)

Overview

A flaw was found in Hugo. When building a Hugo site that uses Node-based asset pipelines (such as PostCSS, Babel, or TailwindCSS), Hugo invoked the configured Node tools without restrictions on file system access. This could allow code running through these tools to read or write files outside the project's working directory when executing Hugo against an untrusted site.

Vendor advisories

• RHSA-2026:66266 · Red Hat · fixed in: Red Hat Hardened Images · released 2026-09-09 · advisory

hugo: Hugo: Arbitrary file read/write via unrestricted file system access in Node-based asset pipelines — rated Important by Red Hat. Released 2026-05-12, updated 2026-10-20.

Fixed:

• Red Hat Hardened Images

Not affected:

• Red Hat Enterprise Linux 10
• Red Hat Hardened Images
• Red Hat OpenShift GitOps
• Red Hat OpenStack Platform 18.0

Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ https://access.redhat.com/errata/RHSA-2026:66266

Workarounds / mitigations:

• Avoid building untrusted Hugo sites, or disable Node-based asset pipelines such as PostCSS, Babel, and TailwindCSS in site configurations. When processing unverified repositories, execute Hugo builds within an isolated, unprivileged container environment.

Package advisory (CVE-2026-44301)

Affected packages:

• github.com/gohugoio/hugo >= 0.43.0, < 0.161.0

Patched in:

• github.com/gohugoio/hugo 0.161.0

Source: https://osv.dev/vulnerability/GHSA-x597-9fr4-5857