EUVD-2026-61008
GHSA-pxpg-7gfv-6wc9
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local build-time execution needs the victim to run a build (UI:R) but no attacker privileges since the config is attacker-supplied (PR:N); escaping the Node permission sandbox to the host account is a scope change (S:C) with full host compromise.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
3DescriptionCVE.org
Hugo 0.161.0 placed the Node asset pipelines behind the Node.js permission model so that code running through PostCSS, Babel, or TailwindCSS could not reach the file system outside the project directory. Hugo 0.162.0 added tailwindcss to the AllowChildProcess default in config/security/securityConfig.go, which makes nodePermissionArgs in common/hexec/exec.go append --allow-child-process whenever the tool being launched is named tailwindcss. TailwindCSS loads the site's tailwind.config.js through require at startup, so top-level code in that file executes inside the permitted Node process and can call child_process to spawn a shell. The spawned process is not a Node process and inherits none of the permission flags, so it runs with the full privileges of the account performing the build. Building a site whose theme, module, or starter template supplies the Tailwind configuration therefore yields arbitrary command execution rather than the confined file access the permission model was introduced to enforce. Hugo 0.165.0 removes tailwindcss from the default security.exec.allow list, so the tool is no longer launched under the default configuration.
Articles & Coverage 2
AnalysisAI
Arbitrary command execution in Hugo 0.162.0 through 0.164.x occurs when the static site generator builds a project whose Tailwind configuration is supplied by an attacker-controlled theme, module, or starter template. Because these releases added tailwindcss to the AllowChildProcess default, Hugo launches the tool with --allow-child-process, and any top-level JavaScript in tailwind.config.js (loaded via require at startup) can spawn a non-Node shell that inherits none of the Node.js permission restrictions and runs with the full privileges of the build account. This is a build-time supply-chain execution flaw with no public exploit identified at time of analysis; it was reported by VulnCheck and fixed in Hugo 0.165.0.
Technical ContextAI
Hugo (cpe:2.3:a:gohugoio:hugo) is a widely used Go-based static site generator. In 0.161.0 it wrapped its Node asset pipelines (PostCSS, Babel, TailwindCSS) in the Node.js permission model so that these tools could only read within the project directory. The regression is an insecure default (CWE-1188, Initialization of a Resource with an Insecure Default): 0.162.0 added 'tailwindcss' to the AllowChildProcess allow list in config/security/securityConfig.go, and nodePermissionArgs in common/hexec/exec.go therefore appends --allow-child-process whenever the launched tool is named tailwindcss. TailwindCSS itself loads the site's tailwind.config.js via require during startup, so top-level code in that file executes inside the permission-granted Node process. Because --allow-child-process was granted, that code can call Node's child_process API to spawn a shell - and the spawned process is not a Node process, so it inherits none of the --allow-read/--allow-write confinement, defeating the very boundary the permission model was meant to enforce.
RemediationAI
Vendor-released patch: upgrade to Hugo 0.165.0 or later, which removes tailwindcss from the default security.exec.allow list per commit https://github.com/gohugoio/hugo/commit/8a55df7af2e6da31297245cc54fa2e3b521d93e8 so the tool is no longer auto-launched with child-process permission. If you cannot upgrade immediately, override the default security configuration to exclude tailwindcss from security.exec.allow (and from security.node.permissions.allowChildProcess), which disables the vulnerable auto-grant at the cost of breaking the built-in Tailwind pipeline until you upgrade. As a complementary control, only build sites from themes, modules, and starter templates you trust and audit any third-party tailwind.config.js for top-level require/child_process calls before building; running builds in an isolated, least-privilege container or CI runner limits blast radius if a malicious config executes. Refer to the VulnCheck advisory and issue #15178 for specifics.
A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could
FortiOS and FortiProxy contain an authentication bypass via the Node.js websocket module allowing unauthenticated remote
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
Eval injection vulnerability in the internals.batch function in lib/batch.js in the bassmaster plugin before 1.5.2 for t
Flowise version 3.0.5 contains a remote code execution vulnerability in the CustomMCP node. The mcpServerConfig paramete
Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to ".." handling was inc
An issue was discovered in the node-serialize package 0.0.4 for Node.js. Rated critical severity (CVSS 9.8), this vulner
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
Directory traversal vulnerability in the st module before 0.2.5 for Node.js allows remote attackers to read arbitrary fi
Multiple SQL injection vulnerabilities in the Manage Accounts page in the AccountManagement.asmx service in the Solarwin
The JS-YAML module before 2.0.5 for Node.js parses input without properly considering the unsafe !!js/function tag, whic
The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a
Vendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today