Your message dated Fri, 28 Aug 2026 08:01:58 +0200
with message-id <[email protected]>
and subject line Re: Accepted hugo 0.165.0-1 (source) into unstable
has caused the Debian Bug report #1144973,
regarding hugo: CVE-2026-75926
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1144973: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1144973
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Source: hugo
Version: 0.162.1-7
Severity: important
Tags: security upstream
X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>
Hi,
The following vulnerability was published for hugo.
CVE-2026-75926[0]:
| Hugo 0.161.0 placed the Node asset pipelines behind the Node.js
| permission model so that code running through PostCSS, Babel, or
| TailwindCSS could not reach the file system outside the project
| directory. Hugo 0.162.0 added tailwindcss to the AllowChildProcess
| default in config/security/securityConfig.go, which makes
| nodePermissionArgs in common/hexec/exec.go append --allow-child-
| process whenever the tool being launched is named tailwindcss.
| TailwindCSS loads the site's tailwind.config.js through require at
| startup, so top-level code in that file executes inside the
| permitted Node process and can call child_process to spawn a shell.
| The spawned process is not a Node process and inherits none of the
| permission flags, so it runs with the full privileges of the account
| performing the build. Building a site whose theme, module, or
| starter template supplies the Tailwind configuration therefore
| yields arbitrary command execution rather than the confined file
| access the permission model was introduced to enforce. Hugo 0.165.0
| removes tailwindcss from the default security.exec.allow list, so
| the tool is no longer launched under the default configuration.
If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2026-75926
https://www.cve.org/CVERecord?id=CVE-2026-75926
[1] https://github.com/gohugoio/hugo/issues/15178
[2] https://github.com/gohugoio/hugo/issues/15171
[3]
https://github.com/gohugoio/hugo/commit/8a55df7af2e6da31297245cc54fa2e3b521d93e8
Regards,
Salvatore
--- End Message ---
--- Begin Message ---
Source: hugo
Source-Version: 0.165.0-1
Hi Tobias!
Thanks for the upload, this fixes as well the two bugs #1141772 and #1144973.
Closing them with the given version.
Thanks for your work!
Regards,
Salvatore
On Thu, Aug 27, 2026 at 09:34:07AM +0000, Debian FTP Masters wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA512
>
> Format: 1.8
> Date: Thu, 27 Aug 2026 11:11:03 +0200
> Source: hugo
> Architecture: source
> Version: 0.165.0-1
> Distribution: unstable
> Urgency: medium
> Maintainer: Debian Go Packaging Team <[email protected]>
> Changed-By: Dr. Tobias Quathamer <[email protected]>
> Changes:
> hugo (0.165.0-1) unstable; urgency=medium
> .
> * New upstream version 0.165.0
> - Refresh patches
> - Build-Depend on golang-github-gohugoio-hashstructure-dev (>= 1.0.0)
> - Build-Depend on golang-github-bep-overlayfs-dev (>= 0.11.0)
> - Remove obsolete path from d/copyright
> .
> - CVE-2026-58402:
> From 0.60.0 until 0.163.3, Hugo's default code-block renderer wrote the
> Markdown code-fence language or info-string into the code
> class="language-…" data-lang="…" wrapper without HTML escaping. A fence
> info-string containing a quote and a script payload breaks out of the
> attribute and injects a live script element. This issue is fixed in
> 0.163.3.
> .
> - CVE-2026-58403:
> From v0.123.0 through v0.163.0, Hugo's virtual filesystem is designed
> so
> that files under a mount cannot reach outside the mount tree, but a
> regression caused RootMappingFs.statRoot to call Stat, which follows
> symlinks, instead of Lstat, so a direct os.ReadFile "somefile" where
> somefile was a symlink pointing outside the mount would return the
> target's contents. This effectively let a symlink planted inside a
> theme or local mount read arbitrary files reachable to the user running
> hugo. This issue is fixed in v0.163.1.
> .
> - CVE-2026-58404:
> From v0.162.0 through v0.163.0, the default security.http.urls policy
> denies requests to loopback, internal, and cloud-metadata IPv4
> literals, but the deny rule only matched dotted-decimal notation, so
> alternate IPv4 encodings of the same addresses, including integer, hex,
> or octal, passed the policy. When a template passes an untrusted or
> data-derived URL to resources.GetRemote and the host platform uses the
> cgo system resolver, these encodings resolve to the blocked address,
> allowing build-time server-side requests to loopback and internal
> services, including the cloud-metadata endpoint in hosted or CI builds;
> the same check is reused on redirects, so the gap also applies to each
> redirect hop. This issue is fixed in v0.163.1.
> .
> - CVE-2026-75926:
> Hugo 0.161.0 placed the Node asset pipelines behind the Node.js
> permission model so that code running through PostCSS, Babel, or
> TailwindCSS could not reach the file system outside the project
> directory. Hugo 0.162.0 added tailwindcss to the AllowChildProcess
> default in config/security/securityConfig.go, which makes
> nodePermissionArgs in common/hexec/exec.go append --allow-child-process
> whenever the tool being launched is named tailwindcss. TailwindCSS
> loads
> the site's tailwind.config.js through require at startup, so top-level
> code in that file executes inside the permitted Node process and can
> call child_process to spawn a shell. The spawned process is not a Node
> process and inherits none of the permission flags, so it runs with the
> full privileges of the account performing the build. Building a site
> whose theme, module, or starter template supplies the Tailwind
> configuration therefore yields arbitrary command execution rather than
> the confined file access the permission model was introduced to
> enforce.
> Hugo 0.165.0 removes tailwindcss from the default security.exec.allow
> list, so the tool is no longer launched under the default
> configuration.
> Checksums-Sha1:
> 9fe58a0ad130d1dd885306e95cf1b57fb3615ef0 6558 hugo_0.165.0-1.dsc
> b366cbeacea9e267c5bb6ee8d848b487662e5d23 9632668 hugo_0.165.0.orig.tar.xz
> b4e651c6b31fc499e58ec22502e05ace191b428d 608620 hugo_0.165.0-1.debian.tar.xz
> cdcb739c241646c5c45d7670525b8b98c7a6fd6a 15846620 hugo_0.165.0-1.git.tar.xz
> 3ce0ab7ca90e568df7baacdaf4adefd5390d35d0 17664
> hugo_0.165.0-1_source.buildinfo
> Checksums-Sha256:
> 4940b58e695832f479bf0edde2f45363e07340ddad9cb7098a5e214f9cb8ae9e 6558
> hugo_0.165.0-1.dsc
> ffaa5bcdf8736cf4e7acce0c3e1d2b179553557b766d08c2dae597fdaa9638b1 9632668
> hugo_0.165.0.orig.tar.xz
> 51c618774f38c64a8f478fa8b3478f6e53b26a4606bd3b256b3f39625156022c 608620
> hugo_0.165.0-1.debian.tar.xz
> b4f3a2ed9f2b2508a4eb846291c23dd4504666a74fba09d2e88c98b123c3da85 15846620
> hugo_0.165.0-1.git.tar.xz
> 109939a5ee279ba609976963cd24996895500ca0a5f553aa63adcae2912f337a 17664
> hugo_0.165.0-1_source.buildinfo
> Files:
> cd4f2707ae3bd94a820fd622c4840295 6558 web optional hugo_0.165.0-1.dsc
> 871aafff94d7a55d6812c0a7a79f8003 9632668 web optional
> hugo_0.165.0.orig.tar.xz
> 1727604ce80f1b7d748514532d954dde 608620 web optional
> hugo_0.165.0-1.debian.tar.xz
> 65c1d248c3459551e3475330dc1b2d32 15846620 web None hugo_0.165.0-1.git.tar.xz
> 3a911d814d21364de5b7bbedf279fcc5 17664 web optional
> hugo_0.165.0-1_source.buildinfo
> Git-Tag-Info: tag=4aa9d6d943894297618cf4b8734a310665124ba2
> fp=d1cb8f39bc5ded24c5d2c78c1302f1f036ebeb19
> Git-Tag-Tagger: Dr. Tobias Quathamer <[email protected]>
>
> -----BEGIN PGP SIGNATURE-----
>
> iQIzBAEBCgAdFiEEN02M5NuW6cvUwJcqYG0ITkaDwHkFAmqQASQACgkQYG0ITkaD
> wHkFdxAAxz6RG4LwTNpFAZ0yGpFGVRMKvSyCqyxI0Zj42lYyFoCmNF1LCsMCvJOo
> 8nW8k4wYvG8qlp0n21Nske3Srz4NcqUkc6INOuNCrPbtj62ftnzj+txhZbrOqd9t
> zuqS3Ru6r3yM1Z+WZBMeoKnFUqJ1OJ4IP+M7Jyf2s5WUZoDYKCIJaPnfwWgeBUaa
> ihIovhutuxtnMwxkju6nSZhW4wyr9bXSoS7RP4Bd+a8PIfmE0qOPKi2qNk4go4qj
> Dmqib2XsyxQ85wM69W5AihpWz6zj4I/dr6wEQ6NnPmyTJYxjYxcsSzu8r21Eh0sj
> bc3YtDOY7SMdmGWtR7K5Jt+nJ8EIfPNyMFiqXvWLbTkIz2i/cPI6U+4rfPuVhVVY
> zmMmYA+tio+5LhT9/vKD5RM+7b2dsaUK/7JbBC2rUtWKcwKzQIKTgSYxgz9D6AQi
> iQ0om76rFokhhdB49bV+HJ5b5Su50rM0ZSTyMt8jgmM9V0kUSxGcgVrITN9du+Q0
> YRz2+a2T4gQVrnAmYBJbykCrPfERpqeoCTAqDF9+1PCVVijMffhigSi0qxrKmVa/
> oaWDwbxE99SvT8onSWA25ST5RNA36cXMaxA+QgEuFWVOTRf9eFxQDdio0ySb/xbN
> JUhT7z3Afs9OMHbs3FQlcdzM23NN2A/twWHpG8f92bPN6v2m18M=
> =58gG
> -----END PGP SIGNATURE-----
--- End Message ---
