CVE-2026-89258

Hugo from v0.161.0 executes Node tools under Node's permission model, but TailwindCSS — included in the default security.exec.allow list — requires a highly permissive configuration (--allow-addons, --allow-child-process, --allow-worker). As a result, the restrictions intended by the fix for GHSA-x597-9fr4-5857 could still be bypassed, allowing a Node tool invoked during a build to read and write files outside the project's working directory. Affected versions are those after v0.43; the issue was fixed in v0.165.0 by removing tailwindcss from the default security.exec.allow list. Users who do not use TailwindCSS, or who only build trusted sites, are not affected. As a workaround, users can define a restrictive security.exec.allow list in hugo.toml.

Hugo's default fenced-code-block renderer writes attribute values taken from the code-fence info string into the rendered HTML without escaping them. New code in markup/internal/attributes/attributes.go converts every attribute value from a byte slice to a string, dropping escaping, and RenderAttributes escapes only values that are still byte slices, so its escaping branch is never reached. A quote inside an attribute value can terminate the attribute and allow a further attribute, including an event handler, to be placed on the wrapper element, causing script execution for every visitor who loads the page.

Hugo does not verify the actual IP address the HTTP client connects to when fetching resources via resources.GetRemote. The security.http.urls allowlist only checks the URL text, not the real destination, allowing access to internal resources.

Hugo 0.162.0 added tailwindcss to the default AllowChildProcess list, causing the Node.js process for TailwindCSS to have child process permissions. Top-level code in tailwind.config.js can execute arbitrary commands, bypassing the Node.js permission model.

In Hugo from version 0.123.0 to 0.161.1, a regression made RootMappingFs.statRoot use Stat (follows symlinks) instead of Lstat, allowing a symlink planted in a local mount (e.g. a vendored themes/ theme) to read arbitrary files accessible to the Hugo user via resources.Get.

A vulnerability in Hugo from v0.162.0 to v0.163.0 allows bypassing the security policy that blocks requests to loopback, internal, and cloud-metadata IPv4 addresses. The policy only matched dotted-decimal notation, so alternative IPv4 encodings (integer, hex, octal) bypassed the block. When a template passes an untrusted URL to resources.GetRemote and the host uses the cgo system resolver, these encodings resolve to blocked addresses, enabling SSRF attacks to internal services and cloud-metadata endpoints in hosted or CI builds.

A vulnerability in Hugo (versions 0.123.0 through 0.163.0) allows bypassing virtual filesystem security. A bug in RootMappingFs.statRoot causes symbolic links inside mounted directories to point outside the mount tree, enabling reading arbitrary files accessible to the user running Hugo.

Hugo from version 0.60.0 to 0.163.3 by default rendered Markdown code blocks without proper HTML escaping in class and data-lang attributes. An info-string containing a quote and JavaScript payload could break out of the attribute and inject a live script element.

In Hugo from version 0.91.0 to 0.162.0, the resources.GetRemote function does not re-validate destination URLs after HTTP 3xx redirects, allowing bypass of the security.http.urls policy. An attacker can redirect the request to a forbidden host, and Hugo will fetch from it.

Hugo before version 0.162.0 accepts content files in various markup formats. Files mapped to the text/html media type (e.g., .html files under /content) are emitted verbatim into the rendered page, enabling stored XSS attacks.