CVE-2026-89259

Starting in Hugo v0.161.0, Node tools executed during builds run under Node's permission model, but the default security.exec.allow list includes tailwindcss, which requires a highly permissive configuration (--allow-addons, --allow-child-process, --allow-worker). This allows the restrictions introduced by the fix for GHSA-x597-9fr4-5857 to be bypassed, so a Node tool invoked during a build can read and write files outside the project's working directory. An attacker who can influence a build (for example, through untrusted content processed by TailwindCSS or a compromised Node tool/dependency) gains unauthorized read and write access to files beyond the project directory on the build machine. Hugo versions after v0.43 but before v0.165.0 are affected, and users who do not use TailwindCSS or who only build trusted sites are not affected. No public proof-of-concept or confirmed in-the-wild exploitation has been reported, and the issue is not in CISA KEV.

What to do: Upgrade to Hugo v0.165.0 or later, which removes tailwindcss from the default security.exec.allow list; as a workaround, define a restrictive security.exec.allow list in hugo.toml. Operators should check whether any build pipelines on v0.161.0 or later invoke TailwindCSS or other Node tools on untrusted input, noting that sites that do not use TailwindCSS or only build trusted content are not affected.