{"schema":"threatline.record/2","record":{"id":"GHSA-r4xx-89rf-5424","aliases":["GHSA-r4xx-89rf-5424"],"summary":" js.Build allowed themes to read files outside the project via ESBuild's fallback resolver","details":"### Summary\r\n\r\nHugo's security model states that only the main project, not external components such as themes, can access files outside the project root. `js.Build`, `js.Batch` and `css.Build` hand imports that are not found in `/assets` over to ESBuild's own resolver, which reads directly from the file system with no notion of the project root and follows symlinks. A theme could ship a JavaScript file with `import secret from \"../secret.txt\"`, or a symlink pointing outside the project, and have the file content bundled into the published site.\r\n\r\n### Impact\r\n\r\nA malicious theme or Hugo module can read any file readable by the build user and publish it as part of the site's JavaScript or CSS output. No user interaction beyond using the theme and running a build is required.\r\n\r\n### Patches\r\n\r\nFixed in v0.167.0. Files loaded by ESBuild outside of Hugo's virtual file system are now checked against the working directory and the paths in `security.node.permissions.allowRead`; anything that resolves outside these, including via symlinks, fails the build.\r\n\r\n### Workarounds\r\n\r\nDo not use themes or modules you do not trust. Review imports in `js.Build`, `js.Batch` and `css.Build` entry points for paths that leave the project.\r\n\r\n### References\r\n\r\n* [Hugo's Security Model](https://gohugo.io/about/security/)\r\n* [`security.node.permissions.allowRead`](https://gohugo.io/configuration/security/#nodepermissionsallowread)\r\n\r\nThanks to @Hama1cco for finding and reporting this issue.\r\n","categories":["Unclassified"],"product":"github.com/gohugoio/hugo","vendor":"","ecosystem":null,"affected_ranges":[{"source":"GitHub Advisory Database","source_url":"https://github.com/gohugoio/hugo/security/advisories/GHSA-r4xx-89rf-5424","source_modified_at":"2026-09-28T15:46:22Z","fetched_at":"2026-10-26T00:08:39.284423Z","package":{"ecosystem":"go","name":"github.com/gohugoio/hugo"},"range":">= v0.84.0"}],"fixed_versions":[],"cvss":null,"severity":"Medium","kev":{"listed":false},"epss":{"probability":null,"percentile":null,"score_date":null},"published_at":"2026-09-28T15:46:22Z","modified_at":"2026-09-28T15:46:22Z","provenance":[{"source":"GitHub Advisory Database","url":"https://github.com/gohugoio/hugo/security/advisories/GHSA-r4xx-89rf-5424","fetched_at":"2026-10-26T00:08:39.284423Z","source_modified_at":"2026-09-28T15:46:22Z"}],"sources":["GitHub Advisory Database"],"references":[],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-09-28T15:46:22Z","content_hash":"4088a34651b448b326c8703973285a775ac03e502b857d9c94e3f4671015100b"}}