GO-2026-5740 Hugo's Node tool execution allows file system access outside the project directory in github.com/gohugoio/hugo

Hugo's Node tool execution allows file system access outside the project directory in github.com/gohugoio/hugo...

NPM: n8n: AI Agents Project Viewer Privilege Escalation via run_node_tool

NPM: n8n: AI Agents Project Viewer Privilege Escalation via runnodetool vulnerability discovered by ? in WordPress Npm n8n versions 2.29.8...

Path Traversal

Hugo is vulnerable to Path Traversal. The vulnerability is due to unrestricted execution of Node-based asset pipeline tools such as PostCSS, Babel, and TailwindCSS during site builds, allowing code from untrusted sites to read or write files outside the project's working directory when processed ...

Linux Distros Unpatched Vulnerability : CVE-2026-44301

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Hugo is a static site generator. From 0.43 to before 0.161.0, when building a Hugo site that uses Node- based asset pipelines PostCSS, Babel, TailwindCSS, Hugo...

CVE-2026-44301 Hugo: Node tool execution allows file system access outside the project directory

Hugo is a static site generator. From 0.43 to before 0.161.0, when building a Hugo site that uses Node-based asset pipelines PostCSS, Babel, TailwindCSS, Hugo invoked the configured Node tools without restrictions on file system access. As a result, executing hugo against an untrusted site could...

Malicious code in religious_vicuna_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 678af0773777c7de09b763d1fca098c7c50881431a1b4ca8d87d249b49a7662c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Code Injection in easy-team/node-tool-utils

Description The node-tool-utils module is vulnerable against RCE since a command is crafted using user inputs not validated and then executedading to arbitrary command injection POC 1. Create the following PoC file: js // poc.js const tool = require'node-tool-utils'; tool.checkPortUsed"test; touc...