Hugo CVE-2026-109574

Exploitation requires the victim to build a Hugo site (version before v0.167.0) that includes an attacker-controlled theme or module, AND that uses the css.Sass transpilation pipeline where the attacker's stylesheet contains a malicious @import or @use target (relative, absolute, or symlinked) resolving outside the project root. Key LIMITING factors: the attacker cannot act remotely - a developer or CI process must voluntarily add the untrusted theme/module and run the build (UI:A, AV:L); only files readable by the build process's user can be exfiltrated; the leaked content must be retrievable from the attacker's reach via the published site CSS; and sites that use only first-party or vetted themes are not exposed.

Signals are consistent and point to a MODERATE, build-time information-disclosure risk rather than an urgent remote-exploitation priority. The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:A/VC:H) correctly models this as a LOCAL attack requiring victim interaction: exploitation occurs when a developer or CI pipeline builds a Hugo site that incorporates an attacker-supplied theme or module, not via a network-facing service. Confidentiality impact is HIGH (arbitrary readable file contents can be leaked) while integrity and availability are None, matching a pure path-traversal file-read. No EPSS score, no CISA KEV listing, and no public POC are present in the input, so exploitation status is 'no public exploit identified at time of analysis.' There is no SSVC decision data provided. The chief risk nuance: PR:N is accurate (the attacker needs no account), but UI:A is load-bearing - the attack is entirely gated on a victim voluntarily importing an untrusted theme/module and running a build, which places this in the supply-chain/trust-decision category rather than mass-exploitable. This is a real but conditional issue: prioritize for teams that build Hugo sites from third-party themes, deprioritize for those using only first-party/vetted themes.

An attacker publishes a seemingly legitimate Hugo theme or module containing a stylesheet whose @import or @use target is a relative, absolute, or symlinked path pointing outside the project root (e.g. to a secrets or config file). A developer adds the theme and runs hugo, and the Sass compiler's import fallback resolves and compiles the out-of-root file, embedding its contents into the published site CSS where the attacker can retrieve it. No public exploit code was identified in the provided data, but the technique is straightforward to reproduce.