---
id: CVE-2026-44301
aliases:
  - GHSA-x597-9fr4-5857
  - GO-2026-5740
title: >-
  Hugo's Node tool execution allows file system access outside the project
  directory
summary: >-
  Hugo's Node tool execution allows file system access outside the project
  directory
severity: medium
vendor: gohugoio
product: github.com/gohugoio/hugo
ecosystem: go
affected:
  - 'github.com/gohugoio/hugo >= 0.43.0, < 0.161.0'
patched:
  - github.com/gohugoio/hugo 0.161.0
published: '2026-05-06'
updated: '2026-07-24'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-x597-9fr4-5857'
references:
  - url: 'https://github.com/gohugoio/hugo/security/advisories/GHSA-x597-9fr4-5857'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-44301'
  - url: 'https://github.com/gohugoio/hugo'
tags:
  - osv
  - go
epss: 0.00428
epssPercentile: 0.34449
ingestedAt: '2026-07-25T19:08:12.148Z'
---

## Overview

## Impact 
When building a Hugo site that uses Node-based asset pipelines (PostCSS, Babel, TailwindCSS), Hugo invoked the configured Node tools without restrictions on file system access. As a result, executing hugo against an untrusted site could allow code running through these tools to read or write files outside the project's working directory.

Users who do not use PostCSS, Babel, or TailwindCSS, or who only build trusted sites, are not affected.

## Patches
From `v0.161.0`, Hugo runs Node tools under Node's permission model with strict defaults: No write access and only read access to the site source directories and files.

## Workarounds
Block these tools in [security.exec.allow](https://gohugo.io/configuration/security/).

## Affected packages

- `github.com/gohugoio/hugo >= 0.43.0, < 0.161.0`

## Remediation

Upgrade to a patched release:

- `github.com/gohugoio/hugo 0.161.0`