Hugo is a static site generator.

Published September 11, 2026 CVE-2026-89259

Hugo is a website-building tool for developers. A flaw let build tools it runs, like TailwindCSS, read or write files outside the project folder when building an untrusted site.

Severity
CriticalCVSS 3.1 · 9.8 · vulncheck.com
Fix
Fixed in 0.165.0
Affected versions
before 0.165.0
Weakness
CWE-250
Affects
Hugo
Exploited
Not confirmedNo confirmation recorded
EU ID
EUVD-2026-76071ENISA vulnerability database

How it works

  • Hugo can run Node-based build tools such as PostCSS, Babel, and TailwindCSS while turning a site's source files into a finished website.
  • Starting in v0.161.0, Hugo tried to fence in those tools using Node's own permission system so they could only touch files inside the project.
  • TailwindCSS needs very broad permissions to run at all, including permissions for native code, child processes, and worker threads, and Hugo's default configuration granted TailwindCSS all of them automatically.
  • That default undid the fence Hugo had just put up.
  • Building a site whose source files or configuration are not fully trusted could let a Node tool invoked during that build read or write files outside the project's working directory.

What to do

Check your installed Hugo version and compare it against the advisory: versions after v0.43 and before v0.165.0 are affected. If your Hugo build uses TailwindCSS in its asset pipeline, check whether the site source you build is one you fully trust, since an untrusted site's build files control what a Node tool can do during that build.

Update Hugo to v0.165.0 or later, which removes tailwindcss from the default security.exec.allow list and closes this gap. If you cannot update yet, add your own restrictive security.exec.allow list in hugo.toml that only allows the specific tools you need and excludes tailwindcss. Watch the GitHub advisory for any further guidance on this fix.

Technical details

Hugo is a static site generator. From v0.161.0, Hugo executes Node tools under Node's permission model, but TailwindCSS — included in the default security.exec.allow list — requires a highly permissive configuration (--allow-addons, --allow-child-process, --allow-worker). As a result, the restrictions intended by the fix for GHSA-x597-9fr4-5857 could still be bypassed, allowing a Node tool invoked during a build to read and write files outside the project's working directory.

Affected versions are those after v0.43; the issue was fixed in v0.165.0 by removing tailwindcss from the default security.exec.allow list. Users who do not use TailwindCSS, or who only build trusted sites, are not affected. As a workaround, users can define a restrictive security.exec.allow list in hugo.toml.

Severity breakdown

  • Attack vector Network Requires network access to the vulnerable service
  • Attack complexity Low Low complexity under the assessed conditions
  • Privileges required None Attacker needs no account or login
  • User interaction None No victim action needed
  • Scope Unchanged Impact stays within the same security authority
  • Confidentiality impact High Sensitive data can be exposed with serious impact
  • Integrity impact High Protected data can be changed with serious impact
  • Availability impact High The service can stop or suffer serious disruption
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Open in FIRST.org calculator

References

View Original Source