CVE-2026-89259
CriticalCVSS 9.8Summary
Hugo from v0.161.0 executes Node tools under Node's permission model, but TailwindCSS — included in the default security.exec.allow list — requires a highly permissive configuration (--allow-addons, --allow-child-process, --allow-worker). As a result, the restrictions intended by the fix for GHSA-x597-9fr4-5857 could still be bypassed, allowing a Node tool invoked during a build to read and write files outside the project's working directory. Affected versions are those after v0.43; the issue was fixed in v0.165.0 by removing tailwindcss from the default security.exec.allow list. Users who do not use TailwindCSS, or who only build trusted sites, are not affected. As a workaround, users can define a restrictive security.exec.allow list in hugo.toml.
Risk Assessment
An attacker could exploit the restriction bypass to read and write files outside the project's working directory, potentially leading to data leakage or file modification. This risk affects organizations using Hugo with TailwindCSS to build sites from untrusted sources.
Recommendation
Update Hugo to v0.165.0 or later, which removes tailwindcss from the default security.exec.allow list. Alternatively, define a restrictive security.exec.allow list in hugo.toml.
Other vulnerabilities in Hugo
See all- CVE-2026-89258Medium
Hugo is a static site generator. In versions after v0.123.0 and before v0.165.0, symlinks in parent directories were not dropped during direct resource lookups, allowing path confinement to be bypassed. An attacker who can place a symlink inside a mounted directory can cause functions such as resources.Get and os.ReadFile to follow that symlink and read files outside the intended project boundaries, disclosing their contents in the built site.
- CVE-2026-10618Medium
Hugo's default fenced-code-block renderer writes attribute values taken from the code-fence info string into the rendered HTML without escaping them. New code in markup/internal/attributes/attributes.go converts every attribute value from a byte slice to a string, dropping escaping, and RenderAttributes escapes only values that are still byte slices, so its escaping branch is never reached. A quote inside an attribute value can terminate the attribute and allow a further attribute, including an event handler, to be placed on the wrapper element, causing script execution for every visitor who loads the page.
- CVE-2026-10582High
Hugo does not verify the actual IP address the HTTP client connects to when fetching resources via resources.GetRemote. The security.http.urls allowlist only checks the URL text, not the real destination, allowing access to internal resources.
- CVE-2026-75926High
Hugo 0.162.0 added tailwindcss to the default AllowChildProcess list, causing the Node.js process for TailwindCSS to have child process permissions. Top-level code in tailwind.config.js can execute arbitrary commands, bypassing the Node.js permission model.
- CVE-2026-50135Medium
In Hugo from version 0.123.0 to 0.161.1, a regression made RootMappingFs.statRoot use Stat (follows symlinks) instead of Lstat, allowing a symlink planted in a local mount (e.g. a vendored themes/ theme) to read arbitrary files accessible to the Hugo user via resources.Get.
- CVE-2026-58404Medium
A vulnerability in Hugo from v0.162.0 to v0.163.0 allows bypassing the security policy that blocks requests to loopback, internal, and cloud-metadata IPv4 addresses. The policy only matched dotted-decimal notation, so alternative IPv4 encodings (integer, hex, octal) bypassed the block. When a template passes an untrusted URL to resources.GetRemote and the host uses the cgo system resolver, these encodings resolve to blocked addresses, enabling SSRF attacks to internal services and cloud-metadata endpoints in hosted or CI builds.
- CVE-2026-58403Medium
A vulnerability in Hugo (versions 0.123.0 through 0.163.0) allows bypassing virtual filesystem security. A bug in RootMappingFs.statRoot causes symbolic links inside mounted directories to point outside the mount tree, enabling reading arbitrary files accessible to the user running Hugo.
- CVE-2026-58402Medium
Hugo from version 0.60.0 to 0.163.3 by default rendered Markdown code blocks without proper HTML escaping in class and data-lang attributes. An info-string containing a quote and JavaScript payload could break out of the attribute and inject a live script element.
- CVE-2026-50134Medium
In Hugo from version 0.91.0 to 0.162.0, the resources.GetRemote function does not re-validate destination URLs after HTTP 3xx redirects, allowing bypass of the security.http.urls policy. An attacker can redirect the request to a forbidden host, and Hugo will fetch from it.
- CVE-2026-50133Medium
Hugo before version 0.162.0 accepts content files in various markup formats. Files mapped to the text/html media type (e.g., .html files under /content) are emitted verbatim into the rendered page, enabling stored XSS attacks.
Original NVD description (English source)
Hugo is a static site generator. From v0.161.0, Hugo executes Node tools under Node's permission model, but TailwindCSS — included in the default security.exec.allow list — requires a highly permissive configuration (--allow-addons, --allow-child-process, --allow-worker). As a result, the restrictions intended by the fix for GHSA-x597-9fr4-5857 could still be bypassed, allowing a Node tool invoked during a build to read and write files outside the project's working directory. Affected versions are those after v0.43; the issue was fixed in v0.165.0 by removing tailwindcss from the default security.exec.allow list. Users who do not use TailwindCSS, or who only build trusted sites, are not affected. As a workaround, users can define a restrictive security.exec.allow list in hugo.toml.