CyberRota Analysis
AI-GeneratedHugo versions from v0.161.0 to v0.164.9 are vulnerable due to a misconfiguration that allows Node tools, particularly TailwindCSS, to execute with excessive permissions, potentially enabling unauthorized file access outside the project directory. This critical vulnerability poses a significant risk for users who build untrusted sites or utilize TailwindCSS, as it could lead to data exposure or manipulation. Organizations using affected versions should prioritize upgrading to v0.165.0 or later, or implement a restrictive security.exec.allow list as a temporary mitigation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Hugo is a static site generator. From v0.161.0, Hugo executes Node tools under Node's permission model, but TailwindCSS — included in the default security.exec.allow list — requires a highly permissive configuration (--allow-addons, --allow-child-process, --allow-worker). As a result, the restrictions intended by the fix for GHSA-x597-9fr4-5857 could still be bypassed, allowing a Node tool invoked during a build to read and write files outside the project's working directory. Affected versions are those after v0.43; the issue was fixed in v0.165.0 by removing tailwindcss from the default security.exec.allow list. Users who do not use TailwindCSS, or who only build trusted sites, are not affected. As a workaround, users can define a restrictive security.exec.allow list in hugo.toml.