CVE-2026-89259
Hugo, a popular static site generator, had a flaw that let Node tools run with too many permissions when TailwindCSS was used. During a site build, an attacker could read or write files outside the project directory. The issue is fixed in Hugo 0.165.0.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Hugo static site generator versions 0.43 through 0.164.9 that use TailwindCSS. Developers who build sites with Hugo and rely on TailwindCSS are affected.
Real-world impact
An attacker could read or modify any file on the build machine while Hugo compiles a site, potentially leaking sensitive data or injecting malicious content.
Why this severity
The CVSS score of 9.3 reflects that the vulnerability gives attackers full control over the build environment, affecting confidentiality, integrity, and availability, with no authentication or user interaction required.
What to do about it
- 01Upgrade Hugo to version 0.165.0 or later.
- 02Restart Hugo or rebuild the site.
- ›If you cannot upgrade immediately, configure a restrictive security.exec.allow list in hugo.toml to limit Node tool execution.
NVD-referenced vendor advisory
Timeline
- Sep 11, 2026 · 2d agoPublishedDisclosed and added to the National Vulnerability Database.
- Sep 11, 2026 · 2d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.