{"schema":"threatline.record/2","record":{"id":"GHSA-3jfr-vjcq-7jvf","aliases":["GHSA-3jfr-vjcq-7jvf"],"summary":"css.Sass allowed themes to read files outside the project via the Sass compiler's import fallback","details":"### Summary\r\n\r\nHugo's security model states that only the main project, not external components such as themes, can access files outside the project root. `css.Sass` resolved `@import` and `@use` targets not found in Hugo's virtual file system by handing them to the Sass compiler (Dart Sass or LibSASS), with the real mount directories as include paths. The compiler reads directly from the file system with no notion of the project root and follows symlinks. A theme could ship a stylesheet with `@import \"../../../../secret\";`, an absolute path, or a symlink pointing outside the project, and have the file content compiled into the published CSS.\r\n\r\n### Impact\r\n\r\nA malicious theme or Hugo module can read Sass and CSS files, or via a symlink any file, readable by the build user and publish the content as part of the site's CSS. No user interaction beyond using the theme and running a build is required.\r\n\r\n### Patches\r\n\r\nFixed in v0.167.0. Imports not found in Hugo's virtual file system are now resolved by Hugo and checked against the working directory and the paths in `security.node.permissions.allowRead`; anything that resolves outside these, including via symlinks, fails the build. This applies to both the Dart Sass and the LibSASS transpiler.\r\n\r\n### Workarounds\r\n\r\nDo not use themes or modules you do not trust. Review `@import` and `@use` statements in `css.Sass` entry points for paths that leave the project.\r\n\r\n### References\r\n\r\n* [Hugo's Security Model](https://gohugo.io/about/security/)\r\n* [`security.node.permissions.allowRead`](https://gohugo.io/configuration/security/#nodepermissionsallowread)\r\n\r\nThanks to @Hama1cco for finding and reporting this issue.\r\n","categories":["Unclassified"],"product":"github.com/gohugoio/hugo","vendor":"","ecosystem":null,"affected_ranges":[{"source":"GitHub Advisory Database","source_url":"https://github.com/gohugoio/hugo/security/advisories/GHSA-3jfr-vjcq-7jvf","source_modified_at":"2026-09-28T15:48:19Z","fetched_at":"2026-10-26T19:10:57.178988Z","package":{"ecosystem":"go","name":"github.com/gohugoio/hugo"},"range":"> v0.167.0"}],"fixed_versions":[],"cvss":null,"severity":"Medium","kev":{"listed":false},"epss":{"probability":null,"percentile":null,"score_date":null},"published_at":"2026-09-28T15:48:19Z","modified_at":"2026-09-28T15:48:19Z","provenance":[{"source":"GitHub Advisory Database","url":"https://github.com/gohugoio/hugo/security/advisories/GHSA-3jfr-vjcq-7jvf","fetched_at":"2026-10-26T19:10:57.178988Z","source_modified_at":"2026-09-28T15:48:19Z"}],"sources":["GitHub Advisory Database"],"references":[],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-09-28T15:48:19Z","content_hash":"f0483145f81d43a1ff6deb21c2613b4714615432a585054332dc7d6a5f729567"}}