CVE-2026-75926: Initialization of a Resource with an Insecure Default in gohugoio hugo
Hugo 0.161.0 placed the Node asset pipelines behind the Node.js permission model so that code running through PostCSS, Babel, or TailwindCSS could not reach the file system outside the project directory. Hugo 0.162.0 added tailwindcss to the AllowChildProcess default in config/security/securityConfig.go, which makes nodePermissionArgs in common/hexec/exec.go append --allow-child-process whenever the tool being launched is named tailwindcss. TailwindCSS loads the site's tailwind.config.js through require at startup, so top-level code in that file executes inside the permitted Node process and can call child_process to spawn a shell. The spawned process is not a Node process and inherits none of the permission flags, so it runs with the full privileges of the account performing the build. Building a site whose theme, module, or starter template supplies the Tailwind configuration therefore yields arbitrary command execution rather than the confined file access the permission model was introduced to enforce. Hugo 0.165.0 removes tailwindcss from the default security.exec.allow list, so the tool is no longer launched under the default configuration.
AI Analysis
Technical Summary
Hugo 0.162.0 introduced a change that added TailwindCSS to the AllowChildProcess default, causing the tool to be launched with the --allow-child-process flag. TailwindCSS loads its tailwind.config.js via require at startup, allowing top-level code in that file to execute within the permitted Node process and spawn child processes. These spawned processes run without Node.js permission restrictions and inherit full privileges of the user running the build. This results in arbitrary command execution during site builds if the Tailwind configuration is supplied by a theme, module, or starter template. Hugo 0.165.0 fixed this by removing TailwindCSS from the default security.exec.allow list, restoring the intended permission confinement.
Potential Impact
An attacker who can supply or modify the TailwindCSS configuration file in a Hugo site build can execute arbitrary commands with the full privileges of the user performing the build. This bypasses the Node.js permission model intended to restrict file system access, potentially leading to full system compromise during site generation.
Mitigation Recommendations
Upgrade Hugo to version 0.165.0 or later, where TailwindCSS is removed from the default allowed child processes list, eliminating this arbitrary command execution vector. No other mitigation is required as the fix is official and addresses the vulnerability directly.
CVE-2026-75926: Initialization of a Resource with an Insecure Default in gohugoio hugo
Description
Hugo 0.161.0 placed the Node asset pipelines behind the Node.js permission model so that code running through PostCSS, Babel, or TailwindCSS could not reach the file system outside the project directory. Hugo 0.162.0 added tailwindcss to the AllowChildProcess default in config/security/securityConfig.go, which makes nodePermissionArgs in common/hexec/exec.go append --allow-child-process whenever the tool being launched is named tailwindcss. TailwindCSS loads the site's tailwind.config.js through require at startup, so top-level code in that file executes inside the permitted Node process and can call child_process to spawn a shell. The spawned process is not a Node process and inherits none of the permission flags, so it runs with the full privileges of the account performing the build. Building a site whose theme, module, or starter template supplies the Tailwind configuration therefore yields arbitrary command execution rather than the confined file access the permission model was introduced to enforce. Hugo 0.165.0 removes tailwindcss from the default security.exec.allow list, so the tool is no longer launched under the default configuration.
CVSS v4.0
Score 9.3critical
Affected software
gohugoio
hugo
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Hugo 0.162.0 introduced a change that added TailwindCSS to the AllowChildProcess default, causing the tool to be launched with the --allow-child-process flag. TailwindCSS loads its tailwind.config.js via require at startup, allowing top-level code in that file to execute within the permitted Node process and spawn child processes. These spawned processes run without Node.js permission restrictions and inherit full privileges of the user running the build. This results in arbitrary command execution during site builds if the Tailwind configuration is supplied by a theme, module, or starter template. Hugo 0.165.0 fixed this by removing TailwindCSS from the default security.exec.allow list, restoring the intended permission confinement.
Potential Impact
An attacker who can supply or modify the TailwindCSS configuration file in a Hugo site build can execute arbitrary commands with the full privileges of the user performing the build. This bypasses the Node.js permission model intended to restrict file system access, potentially leading to full system compromise during site generation.
Mitigation Recommendations
Upgrade Hugo to version 0.165.0 or later, where TailwindCSS is removed from the default allowed child processes list, eliminating this arbitrary command execution vector. No other mitigation is required as the fix is official and addresses the vulnerability directly.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-08-18T15:36:16.466Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6a8482f3c6e8be03326f9af8
Added to database: 08/18/2026, 16:06:11 UTC
Last enriched: 09/25/2026, 02:41:38 UTC
Last updated: 10/02/2026, 14:46:10 UTC
Views: 70
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.