Skip to content
Threat Feed
Subscribe

Product

Hugo (>= 0.43, < 0.165.0)

1 brief RSS
high advisory

Arbitrary File System Access via Hugo Build Process

Hugo versions 0.43 through 0.164.0 include TailwindCSS in the default allowed execution list, enabling Node-based tools to bypass sandbox restrictions and perform unauthorized file read/write operations.

Hugo vulnerability supply-chain static-site-generator
1t 1c