{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/vendors/hugo/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":8.6,"id":"CVE-2026-75926"}],"_cs_exploited":true,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Hugo (0.162.0 to 0.164.0)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"threat","_cs_vendors":["Hugo"],"content_html":"\u003cp\u003eHugo versions 0.162.0 through 0.164.0 introduced a security regression involving the Node.js asset pipeline. While the project aimed to use the Node.js permission model to restrict access for build-time tools like PostCSS and Babel, the inclusion of 'tailwindcss' in the default AllowChildProcess configuration in 'config/security/securityConfig.go' undermined this protection.\u003c/p\u003e\n\u003cp\u003eThe vulnerability arises because TailwindCSS executes the project-supplied 'tailwind.config.js' file at startup. An attacker providing a theme, module, or starter template containing a malicious 'tailwind.config.js' can leverage the permitted Node.js process to call 'child_process' functions. Because the resulting spawned process is not a Node process, it fails to inherit the restricted permission flags, executing instead with the full system privileges of the account running the Hugo build. Hugo 0.165.0 remediated this by removing 'tailwindcss' from the default allow-list.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker creates a malicious 'tailwind.config.js' file containing code designed to invoke 'child_process'.\u003c/li\u003e\n\u003cli\u003eAttacker bundles the malicious file within a Hugo theme, module, or starter template.\u003c/li\u003e\n\u003cli\u003eVictim downloads and initializes the malicious theme or module within their project directory.\u003c/li\u003e\n\u003cli\u003eVictim initiates a site build process using an affected version of Hugo (0.162.0 - 0.164.0).\u003c/li\u003e\n\u003cli\u003eHugo launches the TailwindCSS process under the default Node.js permission model.\u003c/li\u003e\n\u003cli\u003eTailwindCSS, authorized by the default security config, executes the malicious 'tailwind.config.js' during the startup phase.\u003c/li\u003e\n\u003cli\u003eThe script inside 'tailwind.config.js' uses 'child_process' to spawn an external shell or binary.\u003c/li\u003e\n\u003cli\u003eThe spawned process executes with the full privileges of the user running the Hugo build, resulting in arbitrary command execution on the build host.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation results in arbitrary command execution on the system performing the site build. This impacts developers and CI/CD pipelines utilizing affected Hugo versions, potentially leading to unauthorized data exfiltration, local system compromise, or further lateral movement within build environments.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eUpgrade Hugo to version 0.165.0 or later immediately to remove TailwindCSS from the default execution allow-list.\u003c/li\u003e\n\u003cli\u003eAudit projects, especially those utilizing third-party themes, modules, or templates, for the presence of suspicious code within 'tailwind.config.js'.\u003c/li\u003e\n\u003cli\u003eImplement build process monitoring to alert on anomalous child processes (e.g., shells or network tools) spawned by build-time Node.js processes.\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-08-18T16:56:58Z","date_published":"2026-08-18T16:56:58Z","id":"https://feed.craftedsignal.io/briefs/2026-08-18-hugo-cve-2026-75926/","summary":"Hugo versions 0.162.0 through 0.164.0 allowed arbitrary command execution by incorrectly including TailwindCSS in the default Node.js permission sandbox, enabling malicious configurations to spawn unprivileged shell processes.","title":"Arbitrary Command Execution in Hugo via TailwindCSS Configuration","url":"https://feed.craftedsignal.io/briefs/2026-08-18-hugo-cve-2026-75926/"}],"language":"en","title":"CraftedSignal Threat Feed - Hugo","version":"https://jsonfeed.org/version/1.1"}