DEBIAN-CVE-2026-100690

Hugo versions from v0.161.0 through v0.165.0 run Node.js tools css.PostCSS, css.TailwindCSS, js.Babel under the Node.js permission model to restrict file system reads to the project directory and configured mounts. Because the Node.js permission model validates only the lexical path and follows...

CVE-2026-100690

Hugo versions from v0.161.0 through v0.165.0 run Node.js tools css.PostCSS, css.TailwindCSS, js.Babel under the Node.js permission model to restrict file system reads to the project directory and configured mounts. Because the Node.js permission model validates only the lexical path and follows...

CVE-2026-100690 Hugo v0.161.0 to v0.165.0 Arbitrary File Read via Symlinks

Hugo versions from v0.161.0 through v0.165.0 run Node.js tools css.PostCSS, css.TailwindCSS, js.Babel under the Node.js permission model to restrict file system reads to the project directory and configured mounts. Because the Node.js permission model validates only the lexical path and follows...

CVE-2026-100690

Hugo versions v0.161.0 through v0.165.0 are vulnerable to an arbitrary file read due to an oversight in the Node.js permission model. While the model restricts file system reads to the project directory, it validates only the lexical path and follows symbolic links that point outside the allowed ...

CVE-2026-100690 Hugo v0.161.0 to v0.165.0 Arbitrary File Read via Symlinks

Hugo versions from v0.161.0 through v0.165.0 run Node.js tools css.PostCSS, css.TailwindCSS, js.Babel under the Node.js permission model to restrict file system reads to the project directory and configured mounts. Because the Node.js permission model validates only the lexical path and follows...

EUVD-2026-87663

Hugo versions from v0.161.0 through v0.165.0 run Node.js tools css.PostCSS, css.TailwindCSS, js.Babel under the Node.js permission model to restrict file system reads to the project directory and configured mounts. Because the Node.js permission model validates only the lexical path and follows...

CVE-2026-100690 Hugo v0.161.0 to v0.165.0 Arbitrary File Read via Symlinks

Hugo versions from v0.161.0 through v0.165.0 run Node.js tools css.PostCSS, css.TailwindCSS, js.Babel under the Node.js permission model to restrict file system reads to the project directory and configured mounts. Because the Node.js permission model validates only the lexical path and follows...

CVE-2026-100690: Improper Link Resolution Before File Access

Hugo versions from v0.161.0 through v0.165.0 run Node.js tools css.PostCSS, css.TailwindCSS, js.Babel under the Node.js permission model to restrict file system reads to the project directory and configured mounts. Because the Node.js permission model validates only the lexical path and follows...

PT-2026-99361

Name of the Vulnerable Software and Affected Versions Hugo versions 0.161.0 through 0.165.0 Description Node.js tools including css.PostCSS, css.TailwindCSS, and js.Babel are executed under a permission model intended to restrict file system reads to the project directory and configured mounts...