Hugo versions prior to 0.165.0 contain a critical vulnerability that allows unauthenticated attackers to execute arbitrary file operations by leveraging permissive TailwindCSS configurations.

The flaw stems from the inclusion of TailwindCSS in the default security.exec.allow list, which forces Node tools to run with highly permissive flags. This allows a build process to bypass intended sandbox restrictions and perform arbitrary read or write operations on the host system.

Successful exploitation of this vulnerability poses a severe risk to build infrastructure, as an attacker could modify or exfiltrate sensitive source code, configuration files, or environment secrets. Given the CVSS score of 9.8, this vulnerability is categorized as critical, representing a direct threat to the integrity and confidentiality of the entire development and deployment pipeline.

Immediate Action: Update gohugoio Hugo to version 0.165.0 or later immediately to remove TailwindCSS from the default security.exec.allow list.

Proactive Monitoring: Review build logs for unexpected file system access patterns or the invocation of unauthorized Node processes.

Compensating Controls: For environments unable to update immediately, manually modify the hugo.toml configuration file to define a restrictive security.exec.allow list, effectively disabling the permissive TailwindCSS execution.

Public Exploit Available: No

The severity of this vulnerability, combined with its potential for total system impact, necessitates an immediate update to version 0.165.0. Organizations should prioritize patching their CI/CD build environments to ensure that build processes remain isolated and protected from unauthorized file system access.