Critical
Hugo before v0.165.0 Insufficient Permission Restriction via TailwindCSS
Type: advisorySources: OSV
Hugo is a static site generator. From v0.161.0, Hugo executes Node tools under Node's permission model, but TailwindCSS — included in the default security.exec.allow list — requires a highly permissive configuration (--allow-addons, --allow-child-process, --allow-worker). As a result, the restrictions intended by the fix for GHSA-x597-9fr4-5857 could still be bypassed, allowing a Node tool invoked during a build to read and write files outside the project's working directory. Affected versions are those after v0.43; the issue was fixed in v0.165.0 by removing tailwindcss from the default security.exec.allow list. Users who do not use TailwindCSS, or who only build trusted sites, are not affected. As a workaround, users can define a restrictive security.exec.allow list in hugo.toml.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2026-89259
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 4 Nov 2026, 15:50 UTC · Revision 1
Source evidence
Hugo before v0.165.0 Insufficient Permission Restriction via TailwindCSS
core-osv · Original sourcePublished 11 Sept 2026, 11:15 UTC
Hugo is a static site generator. From v0.161.0, Hugo executes Node tools under Node's permission model, but TailwindCSS — included in the default security.exec.allow list — requires a highly permissive configuration (--allow-addons, --allow-child-process, --allow-worker). As a result, the restrictions intended by the fix for GHSA-x597-9fr4-5857 could still be bypassed, allowing a Node tool invoked during a build to read and write files outside the project's working directory. Affected versions are those after v0.43; the issue was fixed in v0.165.0 by removing tailwindcss from the default security.exec.allow list. Users who do not use TailwindCSS, or who only build trusted sites, are not affected. As a workaround, users can define a restrictive security.exec.allow list in hugo.toml.
osv:CVE-2026-89259
Complete source record
{
"id": "10b3b93c4662f2c979d963daeb3bffa19e6cfc9bef3c32e7f61e5656f44836d0",
"url": "https://osv.dev/vulnerability/CVE-2026-89259",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "Hugo before v0.165.0 Insufficient Permission Restriction via TailwindCSS",
"summary": "Hugo is a static site generator. From v0.161.0, Hugo executes Node tools under Node's permission model, but TailwindCSS — included in the default security.exec.allow list — requires a highly permissive configuration (--allow-addons, --allow-child-process, --allow-worker). As a result, the restrictions intended by the fix for GHSA-x597-9fr4-5857 could still be bypassed, allowing a Node tool invoked during a build to read and write files outside the project's working directory. Affected versions are those after v0.43; the issue was fixed in v0.165.0 by removing tailwindcss from the default security.exec.allow list. Users who do not use TailwindCSS, or who only build trusted sites, are not affected. As a workaround, users can define a restrictive security.exec.allow list in hugo.toml.",
"evidence": "osv:CVE-2026-89259",
"products": [],
"severity": "critical",
"structured": {
"id": "CVE-2026-89259",
"aliases": [
"CVE-2026-89259",
"GHSA-vrm6-x8vp-mv2r"
],
"metrics": [
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/gohugoio/hugo",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "76a5e1880ab46688155b02e99bab9be2a6134492"
}
],
"database_specific": {
"extracted_events": [
{
"range": [
{
"introduced": "0"
},
{
"fixed": "0.165.0"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandardRange"
},
{
"range": [
{
"introduced": "0"
},
{
"fixed": "0.165.0"
}
],
"source": "DESCRIPTION"
}
]
}
}
],
"versions": [
"v0.164.0",
"v0.163.3",
"v0.163.2",
"v0.163.1",
"v0.163.0",
"v0.162.1",
"v0.162.0",
"v0.161.1",
"v0.161.0",
"v0.160.1",
"v0.160.0",
"v0.159.2",
"v0.159.1",
"v0.159.0",
"v0.158.0",
"v0.157.0",
"v0.156.0",
"v0.155.3",
"v0.155.2",
"v0.155.1",
"v0.155.0",
"v0.154.5",
"v0.154.4",
"v0.154.3",
"v0.154.2",
"v0.154.1",
"v0.154.0",
"v0.153.5",
"v0.153.4",
"v0.153.3",
"v0.153.2",
"v0.153.1",
"v0.153.0",
"v0.152.2",
"v0.152.1",
"v0.152.0",
"v0.151.1",
"v0.151.0",
"v0.150.1",
"v0.150.0",
"v0.149.1",
"v0.149.0",
"v0.148.2",
"v0.148.1",
"v0.148.0",
"v0.147.9",
"v0.147.8",
"v0.147.7",
"v0.147.6",
"v0.147.5",
"v0.147.3",
"v0.147.2",
"v0.147.1",
"v0.147.0",
"v0.146.7",
"v0.146.6",
"v0.146.5",
"v0.146.4",
"v0.146.3",
"v0.146.2",
"v0.146.1",
"v0.146.0",
"v0.145.0",
"v0.144.1",
"v0.144.0",
"v0.143.1",
"v0.143.0",
"v0.142.0",
"v0.141.0",
"v0.140.2",
"v0.140.1",
"v0.140.0",
"v0.139.4",
"v0.139.3",
"v0.139.2",
"v0.139.1",
"v0.139.0",
"v0.138.0",
"v0.137.1",
"v0.137.0",
"v0.136.5",
"v0.136.3",
"v0.136.2",
"v0.136.1",
"v0.136.0",
"v0.135.0",
"v0.134.3",
"v0.134.2",
"v0.134.1",
"v0.134.0",
"v0.133.1",
"v0.133.0",
"v0.132.2",
"v0.132.1",
"v0.132.0",
"v0.131.0",
"v0.130.0",
"v0.129.0",
"v0.128.2",
"v0.128.1",
"v0.128.0",
"v0.127.0",
"v0.126.3",
"v0.126.1",
"v0.126.0",
"v0.125.7",
"v0.125.6",
"v0.125.5",
"v0.125.4",
"v0.125.2",
"v0.125.1",
"v0.125.0",
"v0.124.1",
"v0.124.0",
"v0.123.8",
"v0.123.7",
"v0.123.6",
"v0.123.5",
"v0.123.4",
"v0.123.3",
"v0.123.2",
"v0.123.1",
"v0.122.0",
"v0.121.2",
"v0.121.1",
"v0.121.0",
"v0.120.4",
"v0.120.3",
"v0.120.2",
"v0.120.1",
"v0.120.0",
"v0.119.0",
"v0.118.2",
"v0.118.1",
"v0.118.0",
"v0.116.1",
"v0.116.0",
"v0.115.4",
"v0.115.3",
"v0.115.2",
"v0.115.1",
"v0.115.0",
"v0.114.0",
"v0.113.0",
"v0.112.7",
"v0.112.6",
"v0.112.4",
"v0.112.3",
"v0.112.2",
"v0.112.1",
"v0.112.0",
"v0.111.3",
"v0.111.2",
"v0.111.1",
"v0.110.0",
"v0.109.0",
"v0.108.0",
"v0.107.0",
"v0.106.0",
"v0.105.0",
"v0.104.3",
"v0.104.2",
"v0.104.1",
"v0.104.0",
"v0.103.1",
"v0.102.3",
"v0.102.0",
"v0.101.0",
"v0.100.2",
"v0.100.1",
"v0.100.0",
"v0.99.1",
"v0.99.0",
"v0.98.0",
"v0.97.3",
"v0.97.2",
"v0.97.1",
"v0.97.0",
"v0.95.0",
"v0.94.2",
"v0.94.1",
"v0.94.0",
"v0.93.3",
"v0.93.2",
"v0.93.1",
"v0.93.0",
"v0.92.2",
"v0.92.1",
"v0.92.0",
"v0.91.2",
"v0.91.1",
"v0.91.0",
"v0.90.1",
"v0.90.0",
"v0.89.4",
"v0.89.3",
"v0.89.2",
"v0.89.1",
"v0.89.0",
"v0.88.1",
"v0.88.0",
"v0.87.0",
"v0.86.0",
"v0.85.0",
"v0.84.4",
"v0.84.3",
"v0.84.2",
"v0.84.1",
"v0.84.0",
"v0.83.1",
"v0.83.0",
"v0.82.0",
"v0.81.0",
"v0.80.0",
"v0.79.0",
"v0.78.2",
"v0.78.1",
"v0.78.0",
"v0.77.0",
"v0.76.4",
"v0.76.2",
"v0.76.1",
"v0.76.0",
"v0.75.1",
"v0.75.0",
"v0.74.3",
"v0.74.2",
"v0.74.1",
"v0.74.0",
"v0.72.0",
"v0.71.1",
"v0.71.0",
"v0.70.0",
"v0.69.2",
"v0.69.1",
"v0.69.0",
"v0.68.3",
"v0.68.2",
"v0.68.1",
"v0.68.0",
"v0.67.1",
"v0.67.0",
"v0.66.0",
"v0.65.3",
"v0.65.2",
"v0.65.1",
"v0.65.0",
"v0.64.1",
"v0.64.0",
"v0.63.2",
"v0.63.1",
"v0.63.0",
"v0.62.2",
"v0.62.1",
"v0.62.0",
"v0.61.0",
"v0.60.1",
"v0.60.0",
"v0.59.1",
"v0.59.0",
"v0.58.3",
"v0.58.2",
"v0.58.1",
"v0.58.0",
"v0.57.2",
"v0.57.1",
"v0.57.0",
"v0.56.3",
"v0.56.2",
"v0.56.0",
"v0.55.5",
"v0.55.4",
"v0.55.3",
"v0.55.2",
"v0.55.1",
"v0.55.0",
"v0.54.0",
"v0.53",
"v0.52",
"v0.51",
"v0.50",
"v0.49",
"v0.48",
"v0.47.1",
"v0.47",
"v0.46",
"v0.45.1",
"v0.45",
"v0.44",
"v0.43",
"v0.42.1",
"v0.40.2",
"v0.40.1",
"v0.40",
"v0.39",
"v0.38.2",
"v0.38.1",
"v0.38",
"v0.37.1",
"v0.37",
"v0.36",
"v0.35",
"v0.34",
"v0.33",
"v0.32.4",
"v0.32.3",
"v0.32.2",
"v0.32.1",
"v0.32",
"v0.31.1",
"v0.31",
"v0.30.2",
"v0.30.1",
"v0.30",
"v0.29",
"v0.28",
"v0.27.1",
"v0.27",
"v0.26",
"v0.25.1",
"v0.25",
"v0.24",
"v0.23",
"v0.22.1",
"v0.22",
"v0.21",
"v0.20.4",
"v0.20.1",
"v0.20",
"v0.19",
"v0.18",
"v0.17",
"v0.16",
"v0.15",
"v0.14",
"v0.13",
"v0.12",
"v0.11",
"v0.10",
"v0.9",
"v0.7"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-89259.json"
}
}
],
"modified": "2026-10-28T02:30:37.051557607Z",
"provider": "osv",
"references": [
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/89xxx/CVE-2026-89259.json",
"https://github.com/gohugoio/hugo/security/advisories/GHSA-vrm6-x8vp-mv2r",
"https://nvd.nist.gov/vuln/detail/CVE-2026-89259",
"https://www.vulncheck.com/advisories/hugo-before-0.165.0-insufficient-permission-restriction-via-tailwindcss"
],
"provider_metadata": {
"cwe_ids": [
"CWE-250"
],
"cna_assigner": "VulnCheck",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/89xxx/CVE-2026-89259.json"
}
},
"related_cves": [
{
"value": "CVE-2026-89259",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 504302,
"published_at": "2026-09-11T11:15:35.062+00:00"
}