Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-89259— Hugo before v0.165.0 Insufficient Permission Restriction via TailwindCSS

Quick assessment

Affected
gohugoio hugo
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Hugo 是一个静态网站生成器。从 v0.161.0 开始，Hugo 在 Node 的权限模型下执行 Node 工具。然而，默认的安全执行白名单（security.exec.allow）中包含的 TailwindCSS 需要非常宽松的配置（--allow-addons、--allow-child-process、--allow-worker）。因此，针对 GHSA-x597-9fr4-5857 的修复所设定的限制仍然可能被绕过，使得构建期间调用的 Node 工具能够读取和写入项目工作目录之外的文件。 受影响的版本是

CVSS 9.8 · Critical

Affected Version Matrix 2

VendorProduct Version RangeStatus
gohugoio hugo < 0.165.0 affected
0.165.0 unaffected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-89259

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Hugo before v0.165.0 Insufficient Permission Restriction via TailwindCSS
Source: CVE Program / CVE List V5
Vulnerability Description
Hugo is a static site generator. From v0.161.0, Hugo executes Node tools under Node's permission model, but TailwindCSS — included in the default security.exec.allow list — requires a highly permissive configuration (--allow-addons, --allow-child-process, --allow-worker). As a result, the restrictions intended by the fix for GHSA-x597-9fr4-5857 could still be bypassed, allowing a Node tool invoked during a build to read and write files outside the project's working directory. Affected versions are those after v0.43; the issue was fixed in v0.165.0 by removing tailwindcss from the default security.exec.allow list. Users who do not use TailwindCSS, or who only build trusted sites, are not affected. As a workaround, users can define a restrictive security.exec.allow list in hugo.toml.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
带着不必要的权限执行
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
gohugoio hugo 0 ~ 0.165.0 -

II. Public POCs for CVE-2026-89259

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-89259

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-89259 (2)

IV. Related Vulnerabilities

Same product: hugo
Same vendor: gohugoio
Same weakness: CWE-250

V. Comments for CVE-2026-89259

No comments yet

Leave a comment