Hugo versions from 0 up to but not including 0.165.0 execute Node tools under Node's permission model starting from v0.161.0. TailwindCSS, included by default in the security.exec.allow list, requires permissive flags (--allow-addons, --allow-child-process, --allow-worker), which can bypass the restrictions intended by a prior fix (GHSA-x597-9fr4-5857). This allows Node tools invoked during site builds to access files outside the project directory, violating intended sandboxing. The vulnerability is resolved in v0.165.0 by removing TailwindCSS from the default allow list. Users can mitigate by customizing the security.exec.allow list to be more restrictive in hugo.toml.

An attacker able to influence the build process can exploit this vulnerability to read and write files outside the intended project directory, potentially leading to unauthorized file access or modification. This breaks the sandboxing model intended to limit Node tool permissions during builds. The impact is critical given the high CVSS 4.0 score of 9.3, indicating network exploitable, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability.

A fix is available in Hugo version 0.165.0, which removes TailwindCSS from the default security.exec.allow list. Users should upgrade to v0.165.0 or later. As a workaround, users can define a restrictive security.exec.allow list in the hugo.toml configuration file to exclude TailwindCSS or limit Node tool permissions. Users who do not use TailwindCSS or only build trusted sites are not affected and may not need to take action.