DEBIAN-CVE-2026-109574

Hugo before v0.167.0 contains a path traversal vulnerability in css.Sass that allows malicious themes or modules to read files outside the project root through the Sass compiler's import fallback. Attackers can ship stylesheets with relative, absolute, or symlinked @import or @use targets to...

CVE-2026-109574

Hugo before v0.167.0 contains a path traversal vulnerability in css.Sass that allows malicious themes or modules to read files outside the project root through the Sass compiler's import fallback. Attackers can ship stylesheets with relative, absolute, or symlinked @import or @use targets to...

CVE-2026-109574

Hugo versions prior to v0.167.0 are vulnerable to a path traversal vulnerability within the css.Sass component. The root cause lies in the Sass compiler's import fallback mechanism, which allows malicious themes or modules to access files outside the project root. Attackers can leverage styleshee...

CVE-2026-109574 Hugo before v0.167.0 Path Traversal via css.Sass Import Fallback

Hugo before v0.167.0 contains a path traversal vulnerability in css.Sass that allows malicious themes or modules to read files outside the project root through the Sass compiler's import fallback. Attackers can ship stylesheets with relative, absolute, or symlinked @import or @use targets to...

CVE-2026-109574 Hugo before v0.167.0 Path Traversal via css.Sass Import Fallback

Hugo before v0.167.0 contains a path traversal vulnerability in css.Sass that allows malicious themes or modules to read files outside the project root through the Sass compiler's import fallback. Attackers can ship stylesheets with relative, absolute, or symlinked @import or @use targets to...

Importing vs fetching JSON

This year, JSON module imports became baseline 'newly available', meaning they're implemented across browser engines. import data from './data.json' with type: 'json' ; // And… const default: data = await import'./data.json', with: type: 'json' , ; I'm glad JavaScript has this feature, but I can'...