gohugoio Hugo up to 0.164.x Node Asset Pipelines common/hexec/exec.go privileges management

Summaryinfo

A vulnerability classified as problematic was found in gohugoio Hugo up to 0.164.x. This impacts an unknown function of the file common/hexec/exec.go of the component Node Asset Pipelines. The manipulation results in privileges management. This vulnerability was named CVE-2026-75926. The attack needs to be approached locally. There is no available exploit.

Detailsinfo

A vulnerability, which was classified as problematic, was found in gohugoio Hugo up to 0.164.x. Affected is an unknown function of the file common/hexec/exec.go of the component Node Asset Pipelines. The manipulation with an unknown input leads to a privileges management vulnerability. CWE is classifying the issue as CWE-269. The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

Hugo 0.161.0 placed the Node asset pipelines behind the Node.js permission model so that code running through PostCSS, Babel, or TailwindCSS could not reach the file system outside the project directory. Hugo 0.162.0 added tailwindcss to the AllowChildProcess default in config/security/securityConfig.go, which makes nodePermissionArgs in common/hexec/exec.go append --allow-child-process whenever the tool being launched is named tailwindcss. TailwindCSS loads the site's tailwind.config.js through require at startup, so top-level code in that file executes inside the permitted Node process and can call child_process to spawn a shell. The spawned process is not a Node process and inherits none of the permission flags, so it runs with the full privileges of the account performing the build. Building a site whose theme, module, or starter template supplies the Tailwind configuration therefore yields arbitrary command execution rather than the confined file access the permission model was introduced to enforce. Hugo 0.165.0 removes tailwindcss from the default security.exec.allow list, so the tool is no longer launched under the default configuration.

The advisory is available at github.com. This vulnerability is traded as CVE-2026-75926 since 08/18/2026. The exploitability is told to be easy. Local access is required to approach this attack. Successful exploitation requires user interaction by the victim. Technical details are known, but there is no available exploit. This vulnerability is assigned to T1068 by the MITRE ATT&CK project.

The vulnerability scanner Nessus provides a plugin with the ID 337942 (Linux Distros Unpatched Vulnerability : CVE-2026-75926), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 0.165.0 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at Tenable (337942). If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Vendor

• gohugoio

Name

• Hugo

Version

• 0.164

Website

• Product: https://github.com/gohugoio/hugo/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion