Insufficient Permissions in Hugo Static Site Generator by GoHugoIO

CVE-2026-89259

What is CVE-2026-89259?

The Hugo static site generator, starting from version 0.161.0, experiences an insufficient permission restriction vulnerability due to the inclusion of TailwindCSS in its default security.exec.allow list. This configuration permits Node tools to operate under a permissive model, potentially allowing those tools to read and write files beyond the designated project directory. While the vulnerability affects versions post 0.43, it was addressed in version 0.165.0 by removing TailwindCSS from the allowance list. Users not utilizing TailwindCSS or those constructing sites that are entirely trusted remain unaffected, and a restrictive security.exec.allow list can be configured as a workaround in hugo.toml.

References