Hugo CVE-2026-89259

Requires that the target uses TailwindCSS (present in Hugo's default security.exec.allow list) and builds an untrusted or attacker-influenced site - the advisory states users who do not use TailwindCSS or who only build trusted sites are not affected. The permissive Node flags (--allow-addons, --allow-child-process, --allow-worker) that TailwindCSS demands are the enabling condition, and exploitation is limited to Hugo versions after v0.43 up to before v0.165.0; it is a build-time execution path, so a build must actually be run against the malicious input.

The published CVSS 4.0 score is 9.3 with vector AV:N/AC:L/AT:N/PR:N/UI:N and VC:H/VI:H/VA:H, but that vector appears overstated for the described threat model. Exploitation is fundamentally a build-time issue: the advisory explicitly states that users who do not use TailwindCSS, or who only build trusted sites, are not affected - meaning an attacker must get malicious content, theme, or configuration into a site that a victim then builds locally or in CI. That implies user interaction (running the build on untrusted input) rather than a purely network-driven, no-interaction attack, and the impact is arbitrary file read/write rather than availability loss, so VA:H is questionable. There is no EPSS figure provided, no KEV listing, and no POC referenced, so this is best treated as a medium-priority hardening/supply-chain concern for teams that build untrusted Hugo sites with TailwindCSS in the pipeline, rather than a mass-exploited remote flaw despite the 9.3 headline.

An attacker submits a malicious Hugo theme, module, or content that hooks into the TailwindCSS build step; when a maintainer or CI pipeline runs hugo on that untrusted input, the Node tool executes with --allow-child-process/--allow-worker and reads or overwrites files outside the project directory (e.g., SSH keys, CI secrets, or other repositories on the build host). No public POC is referenced, and the attack depends on the victim building the attacker-influenced site.