CVE-2026-75926

creationtimestamp| type| source ---|---|--- 2026-08-18 16:39:37+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/6jg2f2xrzxmht 2026-08-18 17:00:59+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mteoxl65zs2b 2026-08-18 18:09:59+00:00| seen|...

CVE-2026-75926 Hugo 0.162.0 to 0.164.x - Node Permission Model Bypass via Default TailwindCSS Child-Process Grant

Hugo 0.161.0 placed the Node asset pipelines behind the Node.js permission model so that code running through PostCSS, Babel, or TailwindCSS could not reach the file system outside the project directory. Hugo 0.162.0 added tailwindcss to the AllowChildProcess default in...