{"id":"EUVD-2026-29862","enisaUuid":"b97843c2-16c6-3a8d-9364-460ced12750a","description":"Hugo is a static site generator. From 0.43 to before 0.161.0, when building a Hugo site that uses Node-based asset pipelines (PostCSS, Babel, TailwindCSS), Hugo invoked the configured Node tools without restrictions on file system access. As a result, executing hugo against an untrusted site could allow code running through these tools to read or write files outside the project\u0027s working directory. Users who do not use PostCSS, Babel, or TailwindCSS, or who only build trusted sites, are not affected. This vulnerability is fixed in 0.161.0.","datePublished":"May 12, 2026, 9:37:52 PM","dateUpdated":"May 13, 2026, 12:13:13 PM","baseScore":6.2,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U","references":"https://github.com/gohugoio/hugo/security/advisories/GHSA-x597-9fr4-5857\n","aliases":"CVE-2026-44301\nGHSA-x597-9fr4-5857\n","assigner":"GitHub_M","epss":0.27,"enisaIdProduct":[{"id":"252daab0-1299-3e98-91c7-af80e1ddc5dd","product":{"name":"hugo","vendor":{"name":"gohugoio"}},"product_version":"0.43.0, \u003c 0.161.0"}],"enisaIdVendor":[{"id":"6b369eb0-a6bc-3bab-9d99-9b665d4d52c7","vendor":{"name":"gohugoio"}}],"enisaIdVulnerability":[{"id":"1a1e9b61-cec0-30d7-8545-a1048d35e4d0","vulnerability":{"id":"CVE-2026-44301","description":"Hugo is a static site generator. From 0.43 to before 0.161.0, when building a Hugo site that uses Node-based asset pipelines (PostCSS, Babel, TailwindCSS), Hugo invoked the configured Node tools without restrictions on file system access. As a result, executing hugo against an untrusted site could allow code running through these tools to read or write files outside the project\u0027s working directory. Users who do not use PostCSS, Babel, or TailwindCSS, or who only build trusted sites, are not affected. This vulnerability is fixed in 0.161.0.","datePublished":"May 12, 2026, 9:37:52 PM","dateUpdated":"May 13, 2026, 12:13:13 PM","status":"PUBLISHED","baseScore":6.2,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U","references":"https://github.com/gohugoio/hugo/security/advisories/GHSA-x597-9fr4-5857\n","enisa_id":"EUVD-2026-29862\n","assigner":"GitHub_M","epss":0.27,"dataProcessed":"Oct 28, 2026, 7:17:27 AM","vulnerabilityProduct":[{"id":"e7747a89-ae83-3230-aef3-02f1d17e141a","product":{"name":"hugo","vendor":{"name":"gohugoio"}},"product_version":"0.43.0, \u003c 0.161.0"}],"vulnerabilityVendor":[{"id":"0c850bca-2fb1-3b45-a19a-7a519739d89c","vendor":{"name":"gohugoio"}}]}},{"id":"f0969117-a3fc-369b-9299-16787d782583","vulnerability":{"id":"GHSA-x597-9fr4-5857","description":"Hugo\u0027s Node tool execution allows file system access outside the project directory","datePublished":"May 6, 2026, 8:59:23 PM","dateUpdated":"May 13, 2026, 4:42:58 PM","baseScore":0.0,"references":"https://github.com/gohugoio/hugo/security/advisories/GHSA-x597-9fr4-5857\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-44301\nhttps://github.com/gohugoio/hugo\n","enisa_id":"EUVD-2026-29862\n","aliases":"CVE-2026-44301\nGHSA-x597-9fr4-5857\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 1:55:50 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[{"id":"cc3e53a0-2803-3bcf-9285-12292cb5ebd2","advisory":{"id":"RHSA-2026:66266","description":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","summary":"An update for Red Hat Hardened Images RPMs is now available.","datePublished":"Sep 9, 2026, 11:14:36 PM","dateUpdated":"Oct 20, 2026, 3:57:18 AM","baseScore":0.0,"references":"https://access.redhat.com/errata/RHSA-2026:66266\nhttps://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_66266.json\n","aliases":"CVE-2026-10582\nCVE-2026-10618\nCVE-2026-33812\nCVE-2026-44301\nCVE-2026-100690\nCVE-2026-100691\nCVE-2026-100692\nCVE-2026-100693\nCVE-2026-100694\n","source":{"id":9,"name":"csaf_redhat"},"advisoryProduct":[{"id":"42c1eddb-66e0-3d95-8f71-deaee1da88ca","product":{"name":"hugo-0:0.166.0-0.1.hum1@src","vendor":{"name":"Red Hat"}}},{"id":"4af09ad1-ff40-359f-94f0-981310e9299d","product":{"name":"hugo-main@x86_64","vendor":{"name":"Red Hat"}}},{"id":"a5ccc638-49cd-3d59-8329-696c73cdc5ca","product":{"name":"hugo-0:0.166.0-0.1.hum1@x86_64","vendor":{"name":"Red Hat"}}},{"id":"b14693ba-51e4-315d-8cfd-0f002de61ee2","product":{"name":"hugo-main@aarch64","vendor":{"name":"Red Hat"}}},{"id":"b6c8df3a-c74b-3954-8c25-82ec22d0098f","product":{"name":"hugo-0:0.166.0-0.1.hum1@aarch64","vendor":{"name":"Red Hat"}}},{"id":"b76b8e89-c063-3589-b185-891a1fb79b07","product":{"name":"hugo-main@src","vendor":{"name":"Red Hat"}}},{"id":"f8c2902d-c58b-3044-9494-3aec74292b0d","product":{"name":"Red Hat Hardened Images","vendor":{"name":"Red Hat"}}}]}}]}