Dong2209

Ghost versions 5.3.0 before 6.62.0 contain a missing authorization vulnerability that allows an authenticated site member to read the excerpts of posts they do not have access to (gated content).

**Name of the Vulnerable Software and Affected Versions** Hugo versions 0.161.0 through 0.165.0 **Description** Node.js tools including `css.PostCSS`, `css.TailwindCSS`, and `js.Babel` are executed under a permission model intended to restrict file system reads to the project directory and configured mounts. However, the model only validates the lexical path and follows symbolic links pointing outside the allowed set, failing to detect symlinks that escape the sandbox. An attacker capable of contributing content to a project can commit a symbolic link pointing to a sensitive file, such as `/etc/passwd`, combined with a PostCSS plugin to read it. This allows any file readable by the build process to be disclosed and potentially embedded in the published site. This issue affects builds using the default security configuration and does not impact projects that do not use Node.js tools. **Recommendations** Update Hugo to version 0.166.0. As a temporary mitigation, avoid using the `css.PostCSS`, `css.TailwindCSS`, and `js.Babel` tools.

**Name of the Vulnerable Software and Affected Versions** Hugo versions 0.75.0 through 0.165.x **Description** A stored cross-site scripting issue exists because the syntax highlighter fails to escape the `lineAnchors` option before passing it to Chroma. This causes the value to be written verbatim into the `id` and `href` attributes of the generated line-number markup. If a crafted `lineAnchors` value is provided via a Markdown code fence attribute or the `highlight` template function, unescaped HTML is rendered on the page, enabling arbitrary JavaScript execution in the browsers of visitors. This specifically impacts sites that build and publish Markdown content from untrusted contributors. **Recommendations** Update Hugo to version 0.166.0.

**Name of the Vulnerable Software and Affected Versions** Hugo versions 0.123.1 through 0.165.x **Description** Symlink confinement checks in the static site generator stop at the mount root. This allows a theme or vendored module located in `themes/` to contain a symlink at a mount root (e.g., `themes/mytheme/assets` pointing to `/some/dir/outside`). Files behind such symlinks can be read during a site build using functions such as `resources.Get()` and `resources.Match()`, and may be published to the `public/` directory via static mounts. This bypasses the requirement that theme and module mount sources must be local paths. Modules fetched via Go modules are not affected as their zip files cannot contain symlinks. **Recommendations** Update to version 0.166.0. Inspect `themes/` and vendored modules for symlinks at mount roots before building. Replace symlinks with explicit mounts.