EUVD-2026-76071
GHSA-c34r-xm66-hh3p
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Exploitation requires a victim to build untrusted content locally with TailwindCSS (AV:L/UI:R); impact is arbitrary file read/write (C:H/I:H) with no availability loss.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
4DescriptionCVE.org
Hugo is a static site generator. From v0.161.0, Hugo executes Node tools under Node's permission model, but TailwindCSS - included in the default security.exec.allow list - requires a highly permissive configuration (--allow-addons, --allow-child-process, --allow-worker). As a result, the restrictions intended by the fix for GHSA-x597-9fr4-5857 could still be bypassed, allowing a Node tool invoked during a build to read and write files outside the project's working directory. Affected versions are those after v0.43; the issue was fixed in v0.165.0 by removing tailwindcss from the default security.exec.allow list. Users who do not use TailwindCSS, or who only build trusted sites, are not affected. As a workaround, users can define a restrictive security.exec.allow list in hugo.toml.
AnalysisAI
Sandbox/permission-restriction bypass in the Hugo static site generator (versions after v0.43, fixed in v0.165.0) lets a Node tool invoked during a build read and write files outside the project's working directory. Because TailwindCSS ships in the default security.exec.allow list and must be run with highly permissive Node flags (--allow-addons, --allow-child-process, --allow-worker), the Node permission model that was supposed to contain build tools (from the fix for GHSA-x597-9fr4-5857) is effectively neutralized. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires that the target uses TailwindCSS (present in Hugo's default security.exec.allow list) and builds an untrusted or attacker-influenced site - the advisory states users who do not use TailwindCSS or who only build trusted sites are not affected. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The published CVSS 4.0 score is 9.3 with vector AV:N/AC:L/AT:N/PR:N/UI:N and VC:H/VI:H/VA:H, but that vector appears overstated for the described threat model. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: upgrade to Hugo v0.165.0, which removes tailwindcss from the default security.exec.allow list so the permissive Node flags are no longer granted automatically. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Hugo installations across development environments and CI/CD pipelines to identify versions 0.44 through 0.164 currently in use. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Hugo is a fast and Flexible Static Site Generator built in Go. Rated high severity (CVSS 8.5), this vulnerability is rem
Arbitrary command execution in Hugo 0.162.0 through 0.164.x occurs when the static site generator builds a project whose
Arbitrary file disclosure in the Hugo static site generator (versions after v0.123.0 and before v0.165.0) lets an attack
Server-side request forgery in Hugo static site generator (versions 0.91.0 through 0.165.0) allows an attacker who can s
Symlink traversal in Hugo's virtual filesystem (v0.123.0-v0.163.0) allows a symlink planted inside a theme or local moun
Stored XSS in Hugo's default code-block renderer allows an attacker with Markdown contribution rights to inject arbitrar
Stored cross-site scripting in Hugo's fenced-code-block renderer (versions 0.93.0 through 0.165.0) allows a low-privileg
Build-time SSRF in Hugo static site generator (v0.162.0-v0.163.0) allows bypass of the `security.http.urls` IP-block pol
Same weakness CWE-250 – Execution with Unnecessary Privileges
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today