---
id: CVE-2026-44301
title: >-
  hugo: Hugo: Arbitrary file read/write via unrestricted file system access in
  Node-based asset pipelines (CVE-2026-44301)
summary: >-
  A flaw was found in Hugo. When building a Hugo site that uses Node-based asset
  pipelines (such as PostCSS, Babel, or TailwindCSS), Hugo invoked the
  configured Node tools without restrictions on file system access. This could
  allow code run…
severity: high
cvss: 7.3
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H'
cvssSource: vendor
cwe: CWE-22
vendor: Red Hat
product: Red Hat Hardened Images
affected:
  - hardened_images
patched:
  - hardened_images
published: '2026-05-12'
updated: '2026-10-20'
sourceUpdated: '2026-10-20T03:56:40+00:00'
source: CSAF
sourceUrl: 'https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44301.json'
references:
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44301.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-44301'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2476862'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-44301'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-44301'
  - url: 'https://github.com/gohugoio/hugo/security/advisories/GHSA-x597-9fr4-5857'
  - url: 'https://access.redhat.com/errata/RHSA-2026:66266'
  - url: 'https://github.com/gohugoio/hugo'
tags:
  - csaf
  - vex
  - red-hat
  - osv
  - go
epss: 0.00274
epssPercentile: 0.19643
aliases:
  - GHSA-x597-9fr4-5857
  - GO-2026-5740
ecosystem: go
ingestedAt: '2026-07-25T19:08:12.148Z'
---

## Overview

A flaw was found in Hugo. When building a Hugo site that uses Node-based asset pipelines (such as PostCSS, Babel, or TailwindCSS), Hugo invoked the configured Node tools without restrictions on file system access. This could allow code running through these tools to read or write files outside the project's working directory when executing Hugo against an untrusted site.

## Vendor advisories

- **RHSA-2026:66266** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-09-09 · [advisory](https://access.redhat.com/errata/RHSA-2026:66266)

**hugo: Hugo: Arbitrary file read/write via unrestricted file system access in Node-based asset pipelines** — rated Important by Red Hat. Released 2026-05-12, updated 2026-10-20.

Fixed:

- Red Hat Hardened Images

Not affected:

- Red Hat Enterprise Linux 10
- Red Hat Hardened Images
- Red Hat OpenShift GitOps
- Red Hat OpenStack Platform 18.0

## Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to:
https://images.redhat.com/ https://access.redhat.com/errata/RHSA-2026:66266

Workarounds / mitigations:

- Avoid building untrusted Hugo sites, or disable Node-based asset pipelines such as PostCSS, Babel, and TailwindCSS in site configurations. When processing unverified repositories, execute Hugo builds within an isolated, unprivileged container environment.

## Package advisory (CVE-2026-44301)

Affected packages:

- `github.com/gohugoio/hugo >= 0.43.0, < 0.161.0`

Patched in:

- `github.com/gohugoio/hugo 0.161.0`

Source: https://osv.dev/vulnerability/GHSA-x597-9fr4-5857