Hugo EUVD-2026-98158

Exploitation requires that the victim's project consume an attacker-controlled Hugo theme or module AND that the project use one of the affected asset-pipeline functions - js.Build, js.Batch, or css.Build - during the build. The malicious component must ship a relative import or symlink resolving outside the project root, and the targeted file must be readable by the build user; only files the build process can read are exposed. Limiting factors: the attack is local (AV:L) and gated by developer/CI action (UI:A) - a maintainer must actively install the hostile component and run a build - so there is no remote, unauthenticated, or default-configuration exposure of a running Hugo-generated site. Risk is confined to the build-time supply chain (local dev machines and CI runners), not to visitors of already-published sites.

This is a genuine but conditional risk that is lower priority than its 6.7 CVSS might suggest to a scanner reading severity alone. All signals point to a constrained, developer-targeted attack rather than mass exploitation: the authoritative CVSS 4.0 vector is AV:L/AC:L/AT:N/PR:N/UI:A, meaning the attack is LOCAL and requires active user interaction - specifically, a Hugo author must choose to install and build with a malicious theme or module. The impact is confidentiality-only (VC:H, VI:N/VA:N), consistent with a file-disclosure (CWE-22) rather than code execution. No EPSS score was provided in the input, so exploitation probability cannot be quantified. KEV status is not listed (treated as not present) and no POC is referenced, so exploitation status is 'no public exploit identified at time of analysis.' The PR:N is worth scrutiny: although no privileges are needed on the victim's machine, exploitation depends entirely on social-engineering a developer into trusting a hostile supply-chain component, so the real-world barrier is higher than PR:N alone implies - the UI:A metric captures that gate. In short, this is a credible supply-chain information-disclosure flaw for CI/build environments, not a remotely-exploitable server vulnerability; prioritize patching for teams that consume third-party Hugo themes/modules, but it is not an emergency network-exposure issue.

An attacker publishes a seemingly useful Hugo theme or module containing a relative import or symlink that points outside the project root (e.g. to ~/.ssh keys, CI secrets, or .env files). When a developer or CI pipeline running a vulnerable Hugo (v0.84.0-v0.166.x) builds the site, ESBuild's fallback resolver in js.Build, js.Batch, or css.Build follows the path and bundles the target file's contents into the published JavaScript or CSS, exfiltrating it to anyone who views the deployed site. No public exploit code is identified at time of analysis, and the local attack vector plus required build action (UI:A) mean exploitation hinges on the victim adopting the malicious component.