CVE-2026-89259
Received Received - Intake

Privilege Escalation in Hugo Static Site Generator via TailwindCSS

Publication date: 2026-09-11

Last updated on: 2026-09-11

Assigner: VulnCheck

Description
Hugo is a static site generator. From v0.161.0, Hugo executes Node tools under Node's permission model, but TailwindCSS — included in the default security.exec.allow list — requires a highly permissive configuration (--allow-addons, --allow-child-process, --allow-worker). As a result, the restrictions intended by the fix for GHSA-x597-9fr4-5857 could still be bypassed, allowing a Node tool invoked during a build to read and write files outside the project's working directory. Affected versions are those after v0.43; the issue was fixed in v0.165.0 by removing tailwindcss from the default security.exec.allow list. Users who do not use TailwindCSS, or who only build trusted sites, are not affected. As a workaround, users can define a restrictive security.exec.allow list in hugo.toml.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-11
Last Modified
2026-09-11
Generated
2026-09-11
AI Q&A
2026-09-11
EPSS Evaluated
N/A
NVD
CVE-2026-89259
EUVD
EUVD-2026-76071

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
hugo hugo From 0.43|end_including=0.165.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-250 The product performs an operation at a privilege level that is higher than the minimum level required, which creates new weaknesses or amplifies the consequences of other weaknesses.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-89259 is a vulnerability in Hugo versions before 0.165.0 where TailwindCSS bypasses security restrictions. Hugo executes Node tools under Node's permission model but TailwindCSS requires permissive flags like --allow-addons, allowing Node tools to read or write files outside the project directory.

Detection Guidance

To detect this vulnerability, check if your Hugo version is below 0.165.0 and if TailwindCSS is in the default security.exec.allow list. Run 'hugo version' to check the version. Inspect hugo.toml for 'security.exec.allow' settings. If TailwindCSS is listed and version is vulnerable, the system is at risk.

Impact Analysis

This vulnerability allows malicious Node tools invoked during Hugo builds to access or modify files outside the project directory, potentially leading to data theft, unauthorized changes, or further system compromise. Users not using TailwindCSS or building trusted sites are unaffected.

Mitigation Strategies

Upgrade Hugo to version 0.165.0 or later. If using TailwindCSS, manually configure a restrictive security.exec.allow list in hugo.toml to exclude TailwindCSS. Remove TailwindCSS from the default allow list if present. Avoid using permissive flags like --allow-addons or --allow-child-process.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-89259. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart