Threat Intelligence Database

CVE-2026-89259 is a critical vulnerability in the Hugo static site generator affecting versions prior to 0.165.0. The issue arises because TailwindCSS, included in the default security.exec.allow list, requires highly permissive Node.js execution permissions, which can bypass intended security restrictions. This allows a Node tool invoked during a build to read and write files outside the project's working directory. The vulnerability was fixed in version 0.165.0 by removing TailwindCSS from the default allow list. Users not using TailwindCSS or only building trusted sites are not affected. A workaround is to define a restrictive security.exec.allow list in the hugo.toml configuration file.

CVE-2026-10618 is a medium severity cross-site scripting (XSS) vulnerability in the Hugo static site generator. The issue arises because Hugo's default fenced-code-block renderer improperly handles attribute values from code-fence info strings, writing them into HTML without proper escaping. This allows an attacker to inject malicious scripts via crafted attribute values, which execute when a user loads the affected page. The vulnerability affects Hugo versions from 0.93.0 through 0.165.0 under default configuration with code fences enabled. No official patch or fix information is provided in the available data.

CVE-2026-10582 is a Server-Side Request Forgery (SSRF) vulnerability in the Hugo static site generator. The security.http.urls allowlist only inspects URL text and does not resolve hostnames or verify the actual IP address connected to, allowing bypass via hostnames resolving to internal or cloud metadata addresses. An attacker able to supply a URL through content fields can cause the build process to fetch internal endpoints and embed the response in the generated site output.

Hugo 0.161.0 placed the Node asset pipelines behind the Node.js permission model so that code running through PostCSS, Babel, or TailwindCSS could not reach the file system outside the project directory. Hugo 0.162.0 added tailwindcss to the AllowChildProcess default in config/security/securityConfig.go, which makes nodePermissionArgs in common/hexec/exec.go append --allow-child-process whenever the tool being launched is named tailwindcss. TailwindCSS loads the site's tailwind.config.js through require at startup, so top-level code in that file executes inside the permitted Node process and can call child_process to spawn a shell. The spawned process is not a Node process and inherits none of the permission flags, so it runs with the full privileges of the account performing the build. Building a site whose theme, module, or starter template supplies the Tailwind configuration therefore yields arbitrary command execution rather than the confined file access the permission model was introduced to enforce. Hugo 0.165.0 removes tailwindcss from the default security.exec.allow list, so the tool is no longer launched under the default configuration.