Skip to content
Threat Feed
Subscribe

Product

Hugo (0.162.0 to 0.164.0)

1 brief RSS
high threat

Arbitrary Command Execution in Hugo via TailwindCSS Configuration

Hugo versions 0.162.0 through 0.164.0 allowed arbitrary command execution by incorrectly including TailwindCSS in the default Node.js permission sandbox, enabling malicious configurations to spawn unprivileged shell processes.

exploited Hugo
1t 1c