CVE-2026-75926

Name of the Vulnerable Software and Affected Versions Hugo versions 0.162.0 through 0.164.x

Description A flaw exists in the Node.js permission model implementation where the tool tailwindcss is added to the default AllowChildProcess list. This allows the tailwind.config.js file to execute top-level code that can call child process to spawn a shell. Because the spawned process is not a Node process, it does not inherit permission flags and runs with the full privileges of the account performing the build. Consequently, building a site using a theme, module, or starter template with a malicious Tailwind configuration can lead to arbitrary command execution, bypassing the intended file system restrictions.

Recommendations Update to version 0.165.0 or later. As a temporary mitigation, restrict the use of the tailwindcss tool in the security configuration to prevent it from being launched under the default configuration.