{"action":"Upgrade hugo to 0.165.0-1 or later.","affected":[{"fixed":"0.165.0-1","introduced":"0"}],"component":"hugo","cve_ids":[],"ecosystem":"Debian","ecosystem_qualifier":"Debian:14","exploited":false,"fixed_versions":["0.165.0-1"],"id":"tcs_01M5NVCRWGWR9X3SRS289FDKGN","modified_at":"2026-10-23T17:47:29.993345974Z","published_at":"2026-08-18T16:18:24.443Z","references":["https://osv.dev/vulnerability/DEBIAN-CVE-2026-75926","https://security-tracker.debian.org/tracker/CVE-2026-75926"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"DEBIAN-CVE-2026-75926","url":"https://osv.dev/vulnerability/DEBIAN-CVE-2026-75926"}],"summary":"Hugo 0.161.0 placed the Node asset pipelines behind the Node.js permission model so that code running through PostCSS, Babel, or TailwindCSS could not reach the file system outside the project directo"}