Hugo (0.162.0 to 0.164.0) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/hugo-0.162.0-to-0.164.0/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioTue, 18 Aug 2026 16:56:58 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgArbitrary Command Execution in Hugo via TailwindCSS Configurationhttps://feed.craftedsignal.io/briefs/2026-08-18-hugo-cve-2026-75926/Tue, 18 Aug 2026 16:56:58 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-08-18-hugo-cve-2026-75926/Hugo versions 0.162.0 through 0.164.0 allowed arbitrary command execution by incorrectly including TailwindCSS in the default Node.js permission sandbox, enabling malicious configurations to spawn unprivileged shell processes.Hugo versions 0.162.0 through 0.164.0 introduced a security regression involving the Node.js asset pipeline. While the project aimed to use the Node.js permission model to restrict access for build-time tools like PostCSS and Babel, the inclusion of 'tailwindcss' in the default AllowChildProcess configuration in 'config/security/securityConfig.go' undermined this protection.

The vulnerability arises because TailwindCSS executes the project-supplied 'tailwind.config.js' file at startup. An attacker providing a theme, module, or starter template containing a malicious 'tailwind.config.js' can leverage the permitted Node.js process to call 'child_process' functions. Because the resulting spawned process is not a Node process, it fails to inherit the restricted permission flags, executing instead with the full system privileges of the account running the Hugo build. Hugo 0.165.0 remediated this by removing 'tailwindcss' from the default allow-list.

Attack Chain

  1. Attacker creates a malicious 'tailwind.config.js' file containing code designed to invoke 'child_process'.
  2. Attacker bundles the malicious file within a Hugo theme, module, or starter template.
  3. Victim downloads and initializes the malicious theme or module within their project directory.
  4. Victim initiates a site build process using an affected version of Hugo (0.162.0 - 0.164.0).
  5. Hugo launches the TailwindCSS process under the default Node.js permission model.
  6. TailwindCSS, authorized by the default security config, executes the malicious 'tailwind.config.js' during the startup phase.
  7. The script inside 'tailwind.config.js' uses 'child_process' to spawn an external shell or binary.
  8. The spawned process executes with the full privileges of the user running the Hugo build, resulting in arbitrary command execution on the build host.

Impact

Successful exploitation results in arbitrary command execution on the system performing the site build. This impacts developers and CI/CD pipelines utilizing affected Hugo versions, potentially leading to unauthorized data exfiltration, local system compromise, or further lateral movement within build environments.

Recommendation

  1. Upgrade Hugo to version 0.165.0 or later immediately to remove TailwindCSS from the default execution allow-list.
  2. Audit projects, especially those utilizing third-party themes, modules, or templates, for the presence of suspicious code within 'tailwind.config.js'.
  3. Implement build process monitoring to alert on anomalous child processes (e.g., shells or network tools) spawned by build-time Node.js processes.
]]>highthreat