github.com/gohugoio/hugo: js.Build allowed themes to read files outside the project via ESBuild's fallback resolver

Summary

Hugo's security model states that only the main project, not external components such as themes, can access files outside the project root. js.Build, js.Batch and css.Build hand imports that are not found in /assets over to ESBuild's own resolver, which reads directly from the file system with no notion of the project root and follows symlinks. A theme could ship a JavaScript file with import secret from "../secret.txt", or a symlink pointing outside the project, and have the file content bundled into the published site.

Impact

A malicious theme or Hugo module can read any file readable by the build user and publish it as part of the site's JavaScript or CSS output. No user interaction beyond using the theme and running a build is required.

Patches

Fixed in v0.167.0. Files loaded by ESBuild outside of Hugo's virtual file system are now checked against the working directory and the paths in security.node.permissions.allowRead; anything that resolves outside these, including via symlinks, fails the build.

Workarounds

Do not use themes or modules you do not trust. Review imports in js.Build, js.Batch and css.Build entry points for paths that leave the project.

References

• Hugo's Security Model
• [security.node.permissions.allowRead](https://gohugo.io/configuration/security/#nodepermissionsallowread)

Thanks to @Hama1cco for finding and reporting this issue.