What’s Vulnerable › Vulnerabilities
CVE-2026-44301: Hugo: Node tool execution allows file system access outside the project directory
- Severity: high (CVSS 8.1 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.3% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-05-12 · updated 2026-10-26
- Weakness: CWE-22
Description
Hugo is a static site generator. From 0.43 to before 0.161.0, when building a Hugo site that uses Node-based asset pipelines (PostCSS, Babel, TailwindCSS), Hugo invoked the configured Node tools without restrictions on file system access. As a result, executing hugo against an untrusted site could allow code running through these tools to read or write files outside the project's working directory. Users who do not use PostCSS, Babel, or TailwindCSS, or who only build trusted sites, are not affected. This vulnerability is fixed in 0.161.0.
Affected products
- gohugoio hugo: from 0.43 before 0.161.0 — fixed in 0.161.0
How to fix
Upgrade to a fixed version: gohugoio hugo 0.161.0. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-44301 or the next vulnerability affects your stack