CVE-2026-75926

Executive Summary

CVE-2026-75926 is a security control bypass in Hugo (the static site generator) versions 0.162.0 through 0.164.x, where TailwindCSS was added to the default AllowChildProcess configuration. This allows top-level code in a site's tailwind.config.js to spawn a shell via child_process, escaping the Node.js permission model that was intended to confine build-time code to the project directory. An attacker who can supply a theme, module, or starter template containing a malicious Tailwind configuration can achieve arbitrary command execution with the full privileges of the build account, resulting in a high-severity local privilege escalation and supply chain risk.

Technical Analysis

Hugo 0.161.0 introduced the Node.js permission model for its Node asset pipelines (PostCSS, Babel, TailwindCSS) to prevent code executed during the build from reaching the file system outside the project directory. In Hugo 0.162.0, the default configuration in config/security/securityConfig.go was modified to add tailwindcss to the AllowChildProcess setting. This change causes nodePermissionArgs in common/hexec/exec.go to append the --allow-child-process flag whenever the tool being launched is named tailwindcss.

TailwindCSS loads the site's tailwind.config.js via require at startup. Because the Node process is launched with --allow-child-process, any top-level code in that configuration file executes inside the permitted Node process and can call child_process to spawn a shell. The spawned process is not a Node process and inherits none of the permission flags, so it runs with the full privileges of the account performing the build. This bypasses the intended confinement, turning a file-access restriction into arbitrary command execution. The vulnerability class is CWE-1188 (Insecure Default Initialization of Resource), as the insecure default configuration enables the escape. The issue is resolved in Hugo 0.165.0 by removing tailwindcss from the default security.exec.allow list, so the tool is no longer launched under the default configuration.

Exploitation Scenarios

1. Reconnaissance/target identification: An attacker identifies a Hugo-based site that uses TailwindCSS and relies on a theme, module, or starter template from an untrusted or compromised source. The attacker may also target a developer or CI/CD pipeline that builds such a site. The attacker must be able to influence the tailwind.config.js file, for example by contributing to a theme repository, publishing a malicious starter template, or compromising an existing dependency.

2. Triggering the flaw: The victim runs a Hugo build (e.g., hugo or hugo server) on a site that includes the malicious tailwind.config.js. Hugo launches TailwindCSS via its Node asset pipeline. Due to the default AllowChildProcess configuration added in 0.162.0, the Node process is started with --allow-child-process. TailwindCSS then loads tailwind.config.js using require, executing any top-level JavaScript code in that file inside the permitted Node process.

3. Payload/execution method: The top-level code in tailwind.config.js calls child_process (e.g., child_process.exec or child_process.spawn) to launch a shell or arbitrary command. Because the spawned process is not a Node process and inherits none of the permission flags, it runs with the full privileges of the account performing the build. The attacker can execute any command, download additional payloads, or establish persistence.

4. Post-exploitation impact: The attacker gains arbitrary command execution on the build system. This can lead to exfiltration of source code, credentials, or secrets present in the build environment; modification of the generated site content; lateral movement within the CI/CD infrastructure; or installation of backdoors. The impact is severe because the build account often has access to deployment keys, cloud credentials, and internal repositories.

No public PoC is available; the attack chain is inferred from the vulnerability class and the NVD description. The likelihood of exploitation is low according to EPSS (0.00218, 11.0th percentile), but the impact is high, and the vulnerability is not listed in CISA KEV.

Impact Assessment

The CVSS v3.1 base score is 8.6 (High), with the vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H. The attack requires local access (AV:L) and user interaction (UI:R) because the victim must initiate a build, but no privileges are required (PR:N) and the attack is low complexity (AC:L). The scope is changed (S:C) because the vulnerable component (Hugo's build process) affects resources beyond its security scope (the underlying operating system). Confidentiality, Integrity, and Availability impacts are all High (C:H/I:H/A:H). Successful exploitation yields arbitrary command execution with the privileges of the build account, potentially compromising the entire build system, source code, and deployment pipeline. The blast radius includes any organization using Hugo 0.162.0–0.164.x with TailwindCSS and untrusted themes, modules, or starter templates. This poses a significant supply chain risk, as a single malicious configuration file can compromise the build environment and, subsequently, the published site.

Detection Guidance

Sigma Rule

title: Hugo TailwindCSS Node Permission Bypass - Child Process Spawn
id: 3f8a2b1c-9d4e-4f7a-8b2c-1d5e6f7a8b9c
status: experimental
description: Detects suspicious child process execution from Node.js when Hugo builds a site with TailwindCSS, indicating exploitation of CVE-2026-75926.
author: Threat Intelligence Team
date: 2026-01-01
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith:
      - '/node'
      - '/nodejs'
  selection_flags:
    CommandLine|contains:
      - '--allow-child-process'
  selection_child:
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/zsh'
      - '/dash'
      - '/cmd.exe'
      - '/powershell.exe'
  condition: selection_parent and selection_flags and selection_child
falsepositives:
  - Legitimate build scripts that spawn shell processes from Node
level: high

YARA Rule

rule CVE_2026_75926_Hugo_Tailwind_ChildProcess
{
    meta:
        description = "Detects tailwind.config.js files containing child_process usage indicative of CVE-2026-75926 exploitation"
        author = "Threat Intelligence Team"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-75926"
        severity = "high"
    strings:
        $a = "child_process" ascii wide nocase
        $b = "exec(" ascii wide nocase
        $c = "spawn(" ascii wide nocase
        $d = "require('child_process')" ascii wide nocase
        $e = "require(\"child_process\")" ascii wide nocase
    condition:
        uint32(0) != 0x504b0304 and
        (any of ($a, $b, $c, $d, $e)) and
        filesize < 1MB
}

Suricata IDS Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2026-75926 Hugo TailwindCSS Child Process Bypass - Outbound Shell Command"; flow:to_server,established; content:"child_process"; nocase; content:"exec"; nocase; distance:0; content:"curl"; nocase; distance:0; classtype:attempted-user; sid:1000001; rev:1;)

Elastic Detection

process where event.type == "start" and
  process.parent.name in ("node", "nodejs") and
  process.parent.command_line : "*--allow-child-process*" and
  process.name in ("sh", "bash", "zsh", "dash", "cmd.exe", "powershell.exe")

Splunk SPL Query

index=main sourcetype=process_creation
| search parent_process_name=node OR parent_process_name=nodejs
| search parent_process_command_line="*--allow-child-process*"
| search process_name IN (sh, bash, zsh, dash, cmd.exe, powershell.exe)
| table _time, host, user, parent_process_name, parent_process_command_line, process_name, process_command_line

Wazuh OSSEC Rule

<group name="hugo,">
  <rule id="100001" level="12">
    <if_sid>500</if_sid>
    <field name="parent_process_name">node|nodejs</field>
    <field name="parent_process_command_line">--allow-child-process</field>
    <field name="process_name">sh|bash|zsh|dash|cmd.exe|powershell.exe</field>
    <description>CVE-2026-75926: Hugo TailwindCSS Node permission bypass - child process spawned</description>
    <mitre>
      <id>T1195</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 4/4 (CONFIRMED — 3+ independent sources confirm fix).

1. Immediate mitigations:

   • Upgrade Hugo to version 0.165.0 or later, which removes tailwindcss from the default security.exec.allow list.
   • If immediate upgrade is not possible, manually edit the Hugo configuration to remove tailwindcss from security.exec.allow and ensure AllowChildProcess does not include tailwindcss.
   • Audit all themes, modules, and starter templates for untrusted tailwind.config.js files. Review their contents for suspicious JavaScript, especially any use of child_process, require('child_process'), exec, or spawn.
   • Restrict build environments to least privilege and isolate CI/CD runners so that a compromised build cannot access sensitive credentials or internal networks.

2. Patch/upgrade steps:

   • Update Hugo to 0.165.0 or newer using the official installation method (package manager, binary download, or Docker image).
   • Verify the installed version with hugo version.
   • Rebuild the site and confirm that TailwindCSS is no longer launched with --allow-child-process under the default configuration.
   • If using a custom security.exec.allow list, ensure tailwindcss is explicitly removed unless absolutely required, and if required, apply additional sandboxing.

3. Long-term hardening:

   • Treat build-time dependencies and configuration files as untrusted code. Implement a policy of reviewing and pinning themes, modules, and starter templates to trusted sources.
   • Use containerized or sandboxed build environments with minimal privileges and no access to production secrets.
   • Monitor for unexpected child processes spawned from Node.js during builds, using the detection rules provided.
   • Regularly update Hugo and all build tooling to the latest secure versions.
   • Apply the principle of least privilege to CI/CD service accounts and rotate credentials that may have been exposed.

References

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-75926
• OSV: https://osv.dev/vulnerability/CVE-2026-75926
• Debian Security Tracker: https://security-tracker.debian.org/tracker/CVE-2026-75926
• Hugo Release Notes for 0.165.0 (vendor advisory): https://github.com/gohugoio/hugo/releases
• CWE-1188: Insecure Default Initialization of Resource: https://cwe.mitre.org/data/definitions/1188.html

No known threat actor campaigns or exploit-in-the-wild evidence have been reported for this CVE. CISA KEV does not list this vulnerability.