CVE-2026-89259

Name of the Vulnerable Software and Affected Versions Hugo versions 0.44 through 0.164

Description When executing Node tools under the Node permission model, the inclusion of TailwindCSS in the default security.exec.allow list requires a highly permissive configuration, specifically using --allow-addons, --allow-child-process, and --allow-worker. This allows a Node tool invoked during a build to bypass intended restrictions and read or write files outside the project working directory.

Recommendations Update to version 0.165.0. As a temporary workaround, define a restrictive security.exec.allow list in hugo.toml.