A critical flaw in Hugo, the static site generator, lets a Node tool invoked during a build read and write files outside the project's working directory, because TailwindCSS shipped in the default security.exec.allow list requires permissions broad enough to defeat Node's permission-model restrictions.
What Is It
Starting with v0.161.0, Hugo began executing Node tools under Node's permission model; an attempt to contain what build-time tooling can touch. The containment leaks. TailwindCSS, present in Hugo's default security.exec.allow list, only functions with a highly permissive configuration: --allow-addons, --allow-child-process, and --allow-worker. Granting those flags hands the tool enough capability to step around the restrictions that the earlier fix for GHSA-x597-9fr4-5857 was supposed to impose. The result is arbitrary file read and write beyond the project directory during a build.
NVD classifies it as CWE-250 (Execution with Unnecessary Privileges), scored CVSS 3.1 9.8 CRITICAL (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), with a CVSS 4.0 secondary score of 9.3.
Why It Matters
Network-reachable, no privileges, no user interaction, full confidentiality/integrity/availability impact on the build host. Static site generators run in CI pipelines and on developer workstations, where a build directory frequently sits alongside credentials, SSH keys, and other repositories. An attacker who can get a malicious site or theme built, a pull request, an untrusted content submission, a third-party module, could gain file access outside the intended boundary.
No CISA KEV entry was supplied for this CVE, so there is no confirmation of active exploitation and no federal remediation deadline attached.
What's Vulnerable
- Vendor/product: gohugoio Hugo (
pkg:golang/github.com/gohugoio/hugo) - Affected: v0.161.0 up to but not including v0.165.0; the releases that execute Node tools under Node's permission model. Note that the published advisory data lists a wider range, beginning at v0.43; that broader range predates the permission-model behavior described as the root cause, so treat v0.161.0–v0.164.x as the window where this specific escape applies and consult the vendor advisory if you are running an earlier release.
- Not affected: v0.165.0 and later; users who do not use TailwindCSS; users who build only trusted sites
Patch Status
Fixed in Hugo v0.165.0, which removes tailwindcss from the default security.exec.allow list. Upgrade is the recommended action.
If you cannot upgrade immediately, the vendor-documented workaround is to define a restrictive security.exec.allow list in hugo.toml rather than relying on the default.
Sources
- Hugo Security Advisory GHSA-vrm6-x8vp-mv2r
- VulnCheck Advisory; Hugo before 0.165.0: insufficient permission restriction via TailwindCSS
- NVD, CVE-2026-89259
Out-of-band: your factual_fidelity note says two fixes are needed but is cut off mid-sentence after the first one, so only the product misidentification was addressed. Resend the second item and I'll apply it.