CVE-2026-89259 gohugoio CVE debrief

Who should care

Users of Hugo, especially those who use TailwindCSS or build sites with Node tools, should assess their exposure and verify remediation. Defining a restrictive security.exec.allow list in hugo.toml can serve as a workaround.

Why it matters

CVE-2026-89259 is a critical vulnerability in Hugo that allows a Node tool invoked during a build to read and write files outside the project's working directory. Users of Hugo, especially those who use TailwindCSS or build sites with Node tools, should assess their exposure and verify remediation. Defining a restrictive security.exec.allow list in hugo.toml can serve as a workaround. The issue was fixed in v0.165.0 by removing tailwindcss from the default security.exec.allow list.

• Potential unauthorized file read and write outside the project's working directory
• Bypass of intended security restrictions in Node tools
• Verification of remediation and exposure required for affected versions
• Update and configuration changes necessary for secure Hugo usage

Technical summary

The vulnerability in Hugo arises from the execution of Node tools under Node's permission model, which can be bypassed by TailwindCSS. This allows a Node tool invoked during a build to read and write files outside the project's working directory. The issue was fixed in v0.165.0 by removing tailwindcss from the default security.exec.allow list. Affected versions are those after v0.43. Users who do not use TailwindCSS, or who only build trusted sites, are not affected. Defining a restrictive security.exec.allow list in hugo.toml can serve as a workaround.

Defensive priority

High

Recommended defensive actions

• Review and update Hugo to version 0.165.0 or later
• Define a restrictive security.exec.allow list in hugo.toml
• Assess exposure and verify remediation for affected versions
• Confirm whether affected Hugo deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, its impact, and the affected versions of Hugo. The issue was fixed in v0.165.0 by removing tailwindcss from the default security.exec.allow list.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.