CVE-2026-75926

Hugo 0.161.0 placed the Node asset pipelines behind the Node.js permission model so that code running through PostCSS, Babel, or TailwindCSS could not reach the file system outside the project directory. Hugo 0.162.0 added tailwindcss to the AllowChildProcess default in config/security/securityConfig.go, which makes nodePermissionArgs in common/hexec/exec.go append --allow-child-process whenever the tool being launched is named tailwindcss. TailwindCSS loads the site's tailwind.config.js through require at startup, so top-level code in that file executes inside the permitted Node process and can call child_process to spawn a shell. The spawned process is not a Node process and inherits none of the permission flags, so it runs with the full privileges of the account performing the build. Building a site whose theme, module, or starter template supplies the Tailwind configuration therefore yields arbitrary command execution rather than the confined file access the permission model was introduced to enforce. Hugo 0.165.0 removes tailwindcss from the default security.exec.allow list, so the tool is no longer launched under the default configuration.

• CWE-1188

• https://github.com/gohugoio/hugo
• https://github.com/gohugoio/hugo/blob/v0.164.0/common/hexec/exec.go#L292-L295
• https://github.com/gohugoio/hugo/blob/v0.164.0/config/security/securityConfig.go#L72-L79
• https://github.com/gohugoio/hugo/commit/8a55df7af2e6da31297245cc54fa2e3b521d93e8
• https://github.com/gohugoio/hugo/issues/15178
• https://www.vulncheck.com/advisories/hugo-to-x-node-permission-model-bypass-via-default-tailwindcss-child-process-grant

Published

Aug 18, 2026

Last Modified

Aug 20, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-7592A weakness has been identified in itsourcecode Courier Manag…7.3
• CVE-2026-75920phpMyFAQ before v4.1.6 writes content backup ZIP archives to…5.3
• CVE-2026-75921The Master Addons for Elementor – Elementor Addons, Widgets,…7.2
• CVE-2026-75922Reverse::Proxy versions before 0.04 for Perl allow HTTP requ…5.3
• CVE-2026-75924A flaw was found in managed-serviceaccount. A compromised ad…8.7
• CVE-2026-75925Improper neutralization of CRLF sequences in IXON VPN Client…9.6
• CVE-2026-75927The PublishPress Capabilities – User Role Editor, Access Per…7.2
• CVE-2026-75928The Brushfire platform's video content streaming application…5.3
• CVE-2026-7593A security vulnerability has been detected in Sunwood-ai-lab…7.3
• CVE-2026-75930The FundEngine – Donation and Crowdfunding Platform plugin f…4.3
• CVE-2026-75931fast-uri is a URI parser for Node.js. It canonicalizes a hos…7.5
• CVE-2026-75932Jet Admin allows an attacker to create a malicious app and c…8.6