Hugo is a static site generator. From 0.43 to before 0.161.0, when building a Hugo site that uses Node-based asset pipelines (PostCSS, Babel, TailwindCSS), Hugo invoked the configured Node tools without restrictions on file system access. As a result, executing hugo against an untrusted site could allow code running through these tools to read or write files outside the project's working directory. Users who do not use PostCSS, Babel, or TailwindCSS, or who only build trusted sites, are not affected. This vulnerability is fixed in 0.161.0.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-667d0938f0 advisory.

    Update to Hugo 0.165.0, which includes security fixes for several CVEs.

    This release fixes CVE-2026-75926 (Tailwind CSS Node permission model bypass) and CVE-2026-89258 (symlink     confinement bypass), as well as earlier escaping and sandbox issues fixed upstream.

    Fedora 44 provides Go 1.26, and Hugo 0.166.0 and later require Go 1.27.0, so 0.165.0 is the newest release     that can be built for this Fedora release.

    The extended edition is built with bundled LibSass, so the package does not depend on a system libsass.

    Release notes: https://github.com/gohugoio/hugo/releases/tag/v0.165.0



Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-9521359c66 advisory.

    Update to Hugo 0.165.0.

    Fedora 43 provides Go 1.26, and Hugo 0.166.0 and later require Go 1.27.0, so 0.165.0 is the newest release     that can be built for this Fedora release. This update therefore skips 0.167.0 and 0.168.0, neither of     which was published for Fedora 43. It is intended to be the final Hugo update for Fedora 43.

    The extended edition is built with bundled LibSass, so the package does not depend on a system libsass.

    Release notes: https://github.com/gohugoio/hugo/releases/tag/v0.165.0



Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 45 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-97aa8e408a advisory.

    Update to Hugo 0.169.0, which includes a security fix.

    Menu `pre` and `post` values defined in front matter are no longer rendered as unescaped HTML. Because     front matter is untrusted content, a content contributor could previously inject arbitrary HTML, including     script, into pages that render menu entries. These values are now HTML escaped unless `text/html` is     allowed in `security.allowContent`, and a `warning-menu-pre-post-html-escaped` warning is logged when     markup is escaped. Menu entries defined in the site configuration are not affected.

    This update also requires Go 1.27.0 and continues to build the extended edition with bundled LibSass, so     the package does not depend on a system libsass.

    Release notes: https://github.com/gohugoio/hugo/releases/tag/v0.169.0




Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Hugo is a static site generator. From 0.43 to before 0.161.0, when building a Hugo site that uses Node-     based asset pipelines (PostCSS, Babel, TailwindCSS), Hugo invoked the configured Node tools without     restrictions on file system access. As a result, executing hugo against an untrusted site could allow code     running through these tools to read or write files outside the project's working directory. Users who do     not use PostCSS, Babel, or TailwindCSS, or who only build trusted sites, are not affected. This     vulnerability is fixed in 0.161.0. (CVE-2026-44301)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Hugo is a static site generator. From 0.43 to before 0.161.0, when building a Hugo site that uses Node-
    based asset pipelines (PostCSS, Babel, TailwindCSS), Hugo invoked the configured Node tools without
    restrictions on file system access. As a result, executing hugo against an untrusted site could allow code
    running through these tools to read or write files outside the project's working directory. Users who do
    not use PostCSS, Babel, or TailwindCSS, or who only build trusted sites, are not affected. This
    vulnerability is fixed in 0.161.0. (CVE-2026-44301)

ID	Name	Product	Family	Type	Severity
381483	Fedora 44 : hugo (2026-667d0938f0)	Nessus	Fedora Local Security Checks	Local	critical
381481	Fedora 43 : hugo (2026-9521359c66)	Nessus	Fedora Local Security Checks	Local	critical
381446	Fedora 45 : hugo (2026-97aa8e408a)	Nessus	Fedora Local Security Checks	Local	critical
314484	Linux Distros Unpatched Vulnerability : CVE-2026-44301	Nessus	Misc.	Local	high
441410	SCA: security update for github.com/gohugoio/hugo (GHSA-x597-9fr4-5857)	Tenable Cloud Security	SCA Checks	Local	high
441410	SCA: security update for github.com/gohugoio/hugo (GHSA-x597-9fr4-5857)	Tenable Self-Hosted Container Security	SCA Checks	Local	high

Detections

Analytics

CVE-2026-44301

high

Tenable Plugins

critical

critical

critical

high

high

high