Description

Hugo 0.161.0 placed the Node asset pipelines behind the Node.js permission model so that code running through PostCSS, Babel, or TailwindCSS could not reach the file system outside the project directory. Hugo 0.162.0 added tailwindcss to the AllowChildProcess default in config/security/securityConfig.go, which makes nodePermissionArgs in common/hexec/exec.go append --allow-child-process whenever the tool being launched is named tailwindcss. TailwindCSS loads the site's tailwind.config.js through require at startup, so top-level code in that file executes inside the permitted Node process and can call child_process to spawn a shell. The spawned process is not a Node process and inherits none of the permission flags, so it runs with the full privileges of the account performing the build. Building a site whose theme, module, or starter template supplies the Tailwind configuration therefore yields arbitrary command execution rather than the confined file access the permission model was introduced to enforce. Hugo 0.165.0 removes tailwindcss from the default security.exec.allow list, so the tool is no longer launched under the default configuration.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.6",
  "pubDate": "2026-08-18T16:18:24.443Z",
  "pubdate": "2026-08-18T16:18:24.443Z",
  "executiveSummary": "An arbitrary command execution vulnerability exists in Hugo versions 0.162.0 through 0.164.x, affecting the Node asset pipeline and its security controls.\nThe vulnerability allows malicious or untrusted Hugo themes, modules, or starter templates containing a crafted tailwind.config.js to achieve full arbitrary command execution on the host system during the site build process.\nThe root cause stems from the default inclusion of tailwindcss in the AllowChildProcess configuration, which inadvertently weakened the Node.js permission model constraints by permitting spawned child processes to bypass permission flags and inherit the full privileges of the user running the Hugo build.\nAn attacker capable of supplying or modifying a Hugo site's configuration, theme, or module can exploit this issue without authentication, leveraging top-level code execution within the Tailwind configuration file to spawn unconstrained system shells.\nThe risk implication is critical, as building an untrusted site can lead to complete host system compromise under the security context of the victim user.\nMitigation requires upgrading Hugo to version 0.165.0 or later, which removes tailwindcss from the default security.exec.allow list.",
  "technicalDetails": "The vulnerability resides within Hugo's handling of Node asset pipelines and its integration with the Node.js permission model, specifically implemented across config/security/securityConfig.go and common/hexec/exec.go.\nIn Hugo 0.161.0, Node asset pipelines running PostCSS, Babel, or TailwindCSS were placed behind the Node.js permission model to restrict file system access strictly to the project directory.\nSubsequently, Hugo 0.162.0 introduced tailwindcss to the AllowChildProcess default within config/security/securityConfig.go. This caused nodePermissionArgs in common/hexec/exec.go to dynamically append the --allow-child-process flag whenever the executing tool was named tailwindcss.\nDuring startup, TailwindCSS loads the target site's tailwind.config.js file using require(). Consequently, any top-level JavaScript code written within tailwind.config.js executes directly inside the permitted Node process.\nBecause the configuration file code executes inside this context, it can invoke Node.js child_process APIs to spawn an external system shell.\nCrucially, the spawned shell process is not a Node process and does not inherit any of the Node.js permission flags. As a result, the spawned process executes with the full system privileges of the account performing the Hugo build, effectively neutralizing the intended security isolation of the permission model.\nExploitation occurs step-by-step when a user attempts to build a Hugo site whose theme, module, or starter template contains a malicious tailwind.config.js file.\nThe build process triggers the execution of tailwindcss under the default security configuration, automatically appending --allow-child-process.\nThe malicious tailwind.config.js file is loaded via require(), executing arbitrary top-level code that spawns a child process capable of executing system commands.\nThis vulnerability affects Hugo versions 0.162.0 through 0.164.x, requires no authentication, and is triggered locally during the build process of untrusted sites, leading to arbitrary command execution with the privileges of the building user."
}