Hugo 0.161.0 implemented a Node.js permission model to restrict asset pipeline tools like PostCSS, Babel, and TailwindCSS from accessing the file system outside the project directory. However, in version 0.162.0, TailwindCSS was added to the AllowChildProcess default list, causing the tool to be launched with the --allow-child-process flag. TailwindCSS loads the site's tailwind.config.js at startup, executing top-level code inside the permitted Node process. This code can spawn child processes via child_process, which run without Node.js permission restrictions and inherit full user privileges. Consequently, building a site with a malicious Tailwind configuration can lead to arbitrary command execution. This vulnerability was addressed in Hugo 0.165.0 by removing TailwindCSS from the default allow list, restoring the intended security model.

An attacker who can supply or modify the TailwindCSS configuration file (tailwind.config.js) in a Hugo project can execute arbitrary commands with the privileges of the user running the Hugo build process. This bypasses the Node.js permission model intended to confine file system access, potentially leading to full system compromise during site builds. The vulnerability affects local builds and any environment where the vulnerable Hugo versions are used to build sites with TailwindCSS configurations.

Hugo 0.165.0 removes TailwindCSS from the default security.exec.allow list, preventing it from being launched with the --allow-child-process flag under default configurations. Users should upgrade to version 0.165.0 or later to mitigate this vulnerability. Until upgrading, avoid building sites with untrusted TailwindCSS configurations or modify the security configuration to disallow child processes for TailwindCSS. Patch status is not explicitly stated but the removal of TailwindCSS from the allow list in 0.165.0 constitutes an official fix.