CVE-2026-44301Disclosure(gohugo / hugo)

LOWCVSS 8.1 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

Hugo is a static site generator. From 0.43 to before 0.161.0, when building a Hugo site that uses Node-based asset pipelines (PostCSS, Babel, TailwindCSS), Hugo invoked the configured Node tools without restrictions on file system access. As a result, executing hugo against an untrusted site could allow code running through these tools to read or write files outside the project's working directory. Users who do not use PostCSS, Babel, or TailwindCSS, or who only build trusted sites, are not affected. This vulnerability is fixed in 0.161.0.

gohugo CVEs Back to dashboard

0.0/ 10 priority

Sources & remediation

Vendor / third-party advisories

https://github.com/gohugoio/hugo/security/advisories/GHSA-x597-9fr4-5857

Weakness type (CWE)

CWE-22

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

hugo

Threat summary

3 mentions across 3 observed days
Momentum state: stable

What's happening

Technical details provided in 3 signals
Disclosure: 3 classified signals
Peaked 2d ago at 1 mentions (2026-05-07); latest day: 1
3 total mentions across 3 days

Affected systems

Vendors

gohugo

Products

hugo

Deep dive

Activity timeline3 mentions / 3d

Signal classification1 categories

Disclosure

3100.0%

Referenced assets3 URLs

By indicator

Full discourse3 posts

CVE@CVEnew150d
Disclosure
CVE-2026-44301 Hugo is a static site generator. From 0.43 to before 0.161.0, when building a Hugo site that uses Node-based asset pipelines (PostCSS, Babel, TailwindCSS), Hugo invok… https://www.cve.org/CVERecord?id=CVE-2026-44301
Post summary
The text identifies CVE-2026-44301 as a vulnerability affecting Hugo versions 0.43 to 0.160.999 during builds that use Node-based asset pipelines, but it does not mention PoCs, active exploitation, or mitigation steps.
0001058
57.5K followersView on X
Vulmon Vulnerability Feed@VulmonFeeds150d
Disclosure
CVE-2026-44301 Unrestricted File System Access in Hugo Node-Based Asset Pipelines Before 0.161.0 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-44301
Post summary
A new CVE-2026-44301 disclosure identifies unrestricted file system access in Hugo Node‑Based Asset Pipelines prior to version 0.161.0.
0000041
4.0K followersView on X
DailyCVE@dailycve156d
Disclosure
🟠 Hugo, Path Traversal, #CVE-2026-44301 (Moderate) https://dailycve.com/hugo-path-traversal-cve-2026-44301-moderate/
Post summary
The tweet links to a DailyCVE article announcing a moderate‑severity path traversal flaw (CVE‑2026‑44301) in Hugo, but it does not provide proof‑of‑concept details, exploit code, or patches.
0000026
196 followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	gohugo	hugo	-	-	-

Explore more

Back to dashboard gohugo CVEs hugo vulnerabilities