Skip to content
OpenAdvisories

Package · Debian

hugo

25 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Critical 9.8
    CVE-2026-89259

    Hugo before v0.165.0 Insufficient Permission Restriction via TailwindCSS

    Hugo is a static site generator. From v0.161.0, Hugo executes Node tools under Node's permission model, but TailwindCSS — included in the default security.exec.allow list — requires a highly permissive configuration (--allow-addons, --allow-child-process, --a…

    gohugoio hugo hugo hugo Debian Ubuntu