github.com/gohugoio/hugo: css.Sass allowed themes to read files outside the project via the Sass compiler's import fallback

Summary

Hugo's security model states that only the main project, not external components such as themes, can access files outside the project root. css.Sass resolved @import and @use targets not found in Hugo's virtual file system by handing them to the Sass compiler (Dart Sass or LibSASS), with the real mount directories as include paths. The compiler reads directly from the file system with no notion of the project root and follows symlinks. A theme could ship a stylesheet with @import "../../../../secret";, an absolute path, or a symlink pointing outside the project, and have the file content compiled into the published CSS.

Impact

A malicious theme or Hugo module can read Sass and CSS files, or via a symlink any file, readable by the build user and publish the content as part of the site's CSS. No user interaction beyond using the theme and running a build is required.

Patches

Fixed in v0.167.0. Imports not found in Hugo's virtual file system are now resolved by Hugo and checked against the working directory and the paths in security.node.permissions.allowRead; anything that resolves outside these, including via symlinks, fails the build. This applies to both the Dart Sass and the LibSASS transpiler.

Workarounds

Do not use themes or modules you do not trust. Review @import and @use statements in css.Sass entry points for paths that leave the project.

References

• Hugo's Security Model
• [security.node.permissions.allowRead](https://gohugo.io/configuration/security/#nodepermissionsallowread)

Thanks to @Hama1cco for finding and reporting this issue.