Hugo versions 0.161.0 through 0.165.0 run Node.js tools (css.PostCSS, css.TailwindCSS, js.Babel) with restricted file system permissions limited to the project directory and configured mounts. However, the Node.js permission model only validates lexical paths and follows symbolic links that may point outside the allowed directories. This allows an attacker who can contribute content (e.g., via pull requests) to commit a symlink pointing outside the sandbox (e.g., to /etc/passwd) and a PostCSS plugin that reads it. Consequently, any file readable by the Hugo build process can be disclosed and potentially embedded in the published site. The vulnerability affects builds using the default security configuration and does not impact projects that do not invoke Node.js tools. The issue is resolved in Hugo 0.166.0 by scanning allowed paths and failing the build if a symbolic link resolves outside them.

An attacker with the ability to contribute content to a Hugo project can exploit this vulnerability to disclose arbitrary files readable by the Hugo build process. This can lead to sensitive information leakage by embedding such files into the published site. The vulnerability affects the default security configuration when Node.js tools are used during the build. There is no indication of active exploitation in the wild.

Upgrade to Hugo version 0.166.0 or later, which includes a fix that scans allowed paths and fails the build if symbolic links resolve outside the permitted directories. Projects that do not invoke Node.js tools are not affected. No additional mitigation is required beyond applying this official fix.