Hugo CVE-2026-100690

Requires ALL of: (1) the Hugo project invokes Node.js-based asset pipelines - css.PostCSS, css.TailwindCSS, or js.Babel (projects that never call these tools are unaffected); (2) the attacker can introduce content into the build tree, e.g. via a pull request or other contribution path, including both an escaping symlink (assets/css/x.css -> /etc/passwd) and a PostCSS plugin configured to read that path; and (3) the project actually builds the attacker-supplied content - automated CI/deploy-preview builds meet this with no human interaction, whereas maintainer-review-then-merge workflows require the maintainer to build the change. It affects the DEFAULT security configuration (no hardening toggle needed), and only Hugo v0.161.0-v0.165.0. Impact is limited to reading files accessible to the build process (confidentiality only); there is no code execution or write primitive.

This is a genuine but conditional confidentiality flaw, not a drop-everything emergency. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N, score 8.7) paints it as trivially exploitable and unauthenticated, but the description reveals meaningful preconditions that AC:L understates: the target project must invoke Hugo's Node.js asset tools (css.PostCSS, css.TailwindCSS, or js.Babel), and the attacker must both plant an escaping symlink AND supply a PostCSS plugin that reads it, then get the project to build that content. I therefore assess AC:H (and AT:P in 4.0), lowering my own 3.1 estimate to ~5.9. Impact is confined to confidentiality (VC:H/VI:N/VA:N, CWE-59 arbitrary file read of anything the build process can read) with no integrity, availability, or code-execution primitive and no scope change. On exploitation signals: EPSS is not provided, the CVE is NOT in CISA KEV, and no POC is referenced - so there is no public exploit identified at time of analysis and no evidence of active exploitation. The PR:N in the vector is defensible only in the sense that anyone can open a pull request; realistic exploitation still hinges on the untrusted content actually being built (automated CI preview builds satisfy this without human review; human-merge workflows add friction). Net: a real, patch-worthy issue for teams that build untrusted contributions with Node.js tooling, but lower real-world urgency than the 8.7 suggests.

An attacker opens a pull request to a public Hugo site repository that uses PostCSS/Tailwind/Babel, adding a symlink like assets/css/x.css pointing to /etc/passwd (or a secrets/env file) plus a PostCSS plugin configured to read it. When the project's build runs on the contributed content - e.g. an automated CI/deploy-preview pipeline - Hugo's Node.js tool follows the symlink outside the sandbox and the target file's contents are read and can be embedded into the generated site. No public exploit code is referenced, but the technique is straightforward and well-described in the advisory.