CVE-2026-100690

Executive Summary

CVE-2026-100690 is a symbolic link (symlink) path traversal vulnerability affecting Hugo static site generator versions v0.161.0 through v0.165.0. When Hugo runs Node.js tools (css.PostCSS, css.TailwindCSS, js.Babel) under the Node.js permission model, the model validates only lexical paths and follows symlinks that resolve outside the configured allowed set, allowing an attacker with content-contribution access to disclose arbitrary files readable by the build process. The vulnerability carries a CVSS v3.1 base score of 7.5 (High) and is currently unpatched in tracked sources, with no public PoC or exploit code available.

Technical Analysis

Hugo is a popular open-source static site generator used to build websites from Markdown and other source content. Starting in v0.161.0, Hugo began invoking Node.js-based tooling (css.PostCSS, css.TailwindCSS, js.Babel) under the Node.js permission model. The Node.js permission model is designed to restrict file system reads to the project directory and any configured mounts, providing a sandbox for build-time JavaScript execution.

The core flaw (CWE-59: Improper Link Resolution Before File Access) is that the Node.js permission model validates only the lexical (string-based) path of a file access. It does not resolve symbolic links to their canonical target before applying the allowed-path policy. Consequently, if a symlink is placed inside an allowed directory but points outside the allowed set (for example, assets/css/x.css -> /etc/passwd), the permission check passes because the lexical path resides within the permitted project directory, while the actual file read follows the symlink to an out-of-sandbox target.

Hugo did not perform its own detection of symlinks escaping the sandbox during the affected version range. Any file readable by the Hugo build process could therefore be disclosed and potentially embedded into the published site output. Builds that do not invoke the Node.js tools are unaffected. The issue affects the default security configuration. The fix in v0.166.0 adds a scan of allowed paths that fails the build when a symbolic link resolves outside them.

Exploitation Scenarios

This vulnerability is a classic symlink-based path traversal at the build-tool layer. No public PoC is available; the attack chain is inferred from the vulnerability class and the NVD description.

1. Reconnaissance / target identification: An attacker identifies a Hugo project (v0.161.0–v0.165.0) that uses Node.js tools (css.PostCSS, css.TailwindCSS, js.Babel) in its build pipeline and accepts external content contributions (e.g., via pull request, shared repository, or any contribution channel). The attacker needs only the ability to add files to the repository.

2. Triggering the flaw: The attacker commits a symbolic link inside an allowed project directory that resolves outside the sandbox. The NVD description provides the concrete example: assets/css/x.css -> /etc/passwd. Because the Node.js permission model validates only the lexical path and follows symlinks, the link passes the allowed-path check even though its target is outside the permitted set.

3. Payload / execution method: Alongside the symlink, the attacker commits a PostCSS plugin (or uses the existing Node.js tool chain) that reads the symlinked file at build time. Since the build runs the Node.js tools under the permission model, the read is permitted at the lexical-path level, and the contents of the target file are returned to the build process.

4. Post-exploitation impact: Any file readable by the Hugo build process can be disclosed and potentially embedded into the published site. Depending on the build host, this could expose sensitive configuration, credentials, or system files. The attacker does not need direct access to the build infrastructure — contribution access to the repository is sufficient.

Impact Assessment

The CVSS v3.1 base score is 7.5 (High) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. This reflects a network-accessible attack (AV:N) with low complexity (AC:L), no privileges required (PR:N), and no user interaction (UI:N). The scope is unchanged (S:U), confidentiality impact is High (C:H), and integrity and availability impacts are None (I:N/A:N).

Business impact centers on information disclosure. Because the vulnerability can expose any file readable by the Hugo build process and embed it into a published site, leaked secrets, configuration files, or internal data could become publicly accessible. The blast radius is limited to projects that (a) run Hugo v0.161.0–v0.165.0 and (b) invoke the Node.js tools under the permission model. Projects that do not invoke Node.js tools are unaffected. The EPSS score is not yet available from FIRST.org, and the CVE is not listed in CISA KEV. There is no public exploit code or Nuclei template as of this writing, which lowers the immediate likelihood of opportunistic exploitation but does not reduce the severity for targeted or insider/supply-chain scenarios.

Detection Guidance

Sigma Rule

title: Hugo Symlink Escape Attempt via Node.js Tool Build (CVE-2026-100690)
id: 8f3a2c1e-4b7d-4e9a-9c2f-6d1e0a5b7c33
status: experimental
description: Detects creation or modification of symbolic links inside Hugo project directories that resolve outside the allowed sandbox, indicative of CVE-2026-100690 exploitation.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-100690
author: valtersit.com
date: 2026/01/01
logsource:
  category: file_event
  product: linux
detection:
  selection_path:
    TargetFilename|contains:
      - '/assets/css/'
      - '/assets/js/'
      - '/assets/'
  selection_symlink:
    EventType: 'symlink'
  condition: selection_path and selection_symlink
falsepositives:
  - Legitimate use of symlinks within the project directory
level: medium
tags:
  - attack.t1195
  - cve.2026.100690

YARA Rule

rule CVE_2026_100690_Hugo_Symlink_Escape
{
    meta:
        description = "Detects symlink artifacts referencing paths outside the Hugo project sandbox associated with CVE-2026-100690"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-100690"
        date = "2026-01-01"
        severity = "high"

    strings:
        $sym1 = "/etc/passwd"
        $sym2 = "/etc/shadow"
        $sym3 = "assets/css/"
        $sym4 = "assets/js/"
        $href = "css.PostCSS"
        $tail = "css.TailwindCSS"
        $babel = "js.Babel"

    condition:
        uint32(0) == 0x04034b50 or
        (
            (any of ($sym1, $sym2)) and
            (any of ($sym3, $sym4))
        ) or
        (
            (any of ($href, $tail, $babel)) and
            (any of ($sym3, $sym4))
        )
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-100690 Hugo Symlink Escape Attempt via Node.js Tool Build"; flow:to_server,established; content:"assets/css/"; http_uri; content:"x.css"; http_uri; reference:cve,2026-100690; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-100690; classtype:attempted-recon; sid:2026100690; rev:1;)

Elastic Detection

file where event.action in ("creation", "modification") and
  file.path : ("*assets/css/*", "*assets/js/*") and
  (file.target_path : ("/etc/*", "/root/*", "/home/*", "/var/*") or
   process.name : ("node", "hugo"))

Splunk SPL Query

index=main (sourcetype=linux_audit OR sourcetype=sysmon_linux OR sourcetype=osquery)
(EventType=symlink OR action=created OR type=SYMLINK)
| search (TargetFilename="*assets/css/*" OR TargetFilename="*assets/js/*" OR file_path="*assets/css/*" OR file_path="*assets/js/*")
| stats count min(_time) as first_seen max(_time) as last_seen by host, user, TargetFilename, file_path
| where count > 0
| sort - last_seen

Wazuh OSSEC Rule

<group name="hugo,symlink_escape,cve_2026_100690,">
  <rule id="100690" level="10">
    <if_sid>550</if_sid>
    <field name="file">assets/css/|assets/js/</field>
    <match>symlink|-></match>
    <description>CVE-2026-100690: Possible Hugo symlink escape for Node.js tool build - suspicious symlink in project assets</description>
    <mitre>
      <id>T1195</id>
    </mitre>
    <group>cve_2026_100690,</group>
  </rule>

  <rule id="100691" level="12">
    <if_sid>100690</if_sid>
    <match>/etc/passwd|/etc/shadow|/root/</match>
    <description>CVE-2026-100690: Hugo symlink resolves to sensitive system file - likely exploitation attempt</description>
    <group>cve_2026_100690,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor workarounds are documented in the provided data.

1. Immediate mitigations:

• Restrict who can contribute content or commit files to Hugo repositories that build with Node.js tools (css.PostCSS, css.TailwindCSS, js.Babel). Require review of any newly added symlinks in pull requests.
• Audit existing repositories for symbolic links (especially under assets/css/ and assets/js/) that resolve outside the project directory, and remove any that are not explicitly required.
• If your build does not require the Node.js tools, disable them so builds do not run under the Node.js permission model (projects that do not invoke Node.js tools are unaffected).
• Run Hugo builds in a least-privilege sandbox/container and limit the build process to only the files it genuinely needs, reducing the set of files an escaping symlink could disclose.

2. Patch/upgrade steps:

• Upgrade Hugo to v0.166.0 or later. Version v0.166.0 scans allowed paths and fails the build when a symbolic link resolves outside them, directly addressing the root cause.
• After upgrading, verify builds fail safely when a symlink escapes the allowed set, and re-run your build pipeline to confirm behavior.

3. Long-term hardening:

• Enforce CI policy that rejects symlinks resolving outside the repository root as part of merge checks.
• Adopt least-privilege build runners and isolate secrets from build hosts so that any file disclosure has limited value.
• Continuously monitor for advisories and patch Hugo and Node.js tooling promptly; treat build-time tool execution as a supply-chain trust boundary (T1195).

References

• NVD — CVE-2026-100690: https://nvd.nist.gov/vuln/detail/CVE-2026-100690
• CWE-59: Improper Link Resolution Before File Access ('Link Following'): https://cwe.mitre.org/data/definitions/59.html
• Hugo project releases (fixed in v0.166.0): https://github.com/gohugoio/hugo/releases
• MITRE ATT&CK T1195 — Supply Chain Compromise: https://attack.mitre.org/techniques/T1195/
• CISA Known Exploited Vulnerabilities Catalog (CVE-2026-100690 not listed as of this report): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No public PoC, exploit code, or Nuclei template is available. No exploit-in-the-wild evidence or associated threat actor campaigns have been identified in the provided data. EPSS has not yet scored this CVE.