CVE-2026-75926

A flaw was found in Hugo. This vulnerability enables arbitrary command execution by bypassing security restrictions designed to confine asset-processing tools. Because TailwindCSS is granted permission to create child processes by default, an attacker providing a malicious theme, module, or...

Malicious code in tailwindcss-form-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9ee530ea41c8bfbb1574bee19e02b9bf7f319e9dd93300513f4be599eebbc3db The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-17221 Malicious code in tailwindcss-form-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9ee530ea41c8bfbb1574bee19e02b9bf7f319e9dd93300513f4be599eebbc3db The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

CVE-2026-100690

Hugo versions from v0.161.0 through v0.165.0 run Node.js tools css.PostCSS, css.TailwindCSS, js.Babel under the Node.js permission model to restrict file system reads to the project directory and configured mounts. Because the Node.js permission model validates only the lexical path and follows...

UBUNTU-CVE-2026-100690

Hugo versions from v0.161.0 through v0.165.0 run Node.js tools css.PostCSS, css.TailwindCSS, js.Babel under the Node.js permission model to restrict file system reads to the project directory and configured mounts. Because the Node.js permission model validates only the lexical path and follows...

CVE-2026-100690

Hugo versions from v0.161.0 through v0.165.0 run Node.js tools css.PostCSS, css.TailwindCSS, js.Babel under the Node.js permission model to restrict file system reads to the project directory and configured mounts. Because the Node.js permission model validates only the lexical path and follows...

CVE-2026-89259

Hugo is a static site generator. From v0.161.0, Hugo executes Node tools under Node's permission model, but TailwindCSS — included in the default security.exec.allow list — requires a highly permissive configuration --allow-addons, --allow-child-process, --allow-worker. As a result, the...

DEBIAN-CVE-2026-89259

Hugo is a static site generator. From v0.161.0, Hugo executes Node tools under Node's permission model, but TailwindCSS — included in the default security.exec.allow list — requires a highly permissive configuration --allow-addons, --allow-child-process, --allow-worker. As a result, the...

CVE-2026-89259

Hugo is a static site generator. From v0.161.0, Hugo executes Node tools under Node's permission model, but TailwindCSS — included in the default security.exec.allow list — requires a highly permissive configuration --allow-addons, --allow-child-process, --allow-worker. As a result, the...

UBUNTU-CVE-2026-89259

Hugo is a static site generator. From v0.161.0, Hugo executes Node tools under Node's permission model, but TailwindCSS — included in the default security.exec.allow list — requires a highly permissive configuration --allow-addons, --allow-child-process, --allow-worker. As a result, the...

CVE-2026-89259 Hugo before v0.165.0 Insufficient Permission Restriction via TailwindCSS

Hugo is a static site generator. From v0.161.0, Hugo executes Node tools under Node's permission model, but TailwindCSS — included in the default security.exec.allow list — requires a highly permissive configuration --allow-addons, --allow-child-process, --allow-worker. As a result, the...

CVE-2026-89259 Hugo before v0.165.0 Insufficient Permission Restriction via TailwindCSS

Hugo is a static site generator. From v0.161.0, Hugo executes Node tools under Node's permission model, but TailwindCSS — included in the default security.exec.allow list — requires a highly permissive configuration --allow-addons, --allow-child-process, --allow-worker. As a result, the...

CVE-2026-89259 Hugo before v0.165.0 Insufficient Permission Restriction via TailwindCSS

Hugo is a static site generator. From v0.161.0, Hugo executes Node tools under Node's permission model, but TailwindCSS — included in the default security.exec.allow list — requires a highly permissive configuration --allow-addons, --allow-child-process, --allow-worker. As a result, the...

EUVD-2026-76071

Hugo is a static site generator. From v0.161.0, Hugo executes Node tools under Node's permission model, but TailwindCSS — included in the default security.exec.allow list — requires a highly permissive configuration --allow-addons, --allow-child-process, --allow-worker. As a result, the...

CVE-2026-89259

Hugo , a static site generator, introduced Node's permission model in v0.161.0 to restrict tools executed during builds. However, TailwindCSS — present in the default security.exec.allow list — requires highly permissive flags (--allow-addons, --allow-child-process, --allow-worker), effectively b...

Linux Distros Unpatched Vulnerability : CVE-2026-89259

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Hugo is a static site generator. From v0.161.0, Hugo executes Node tools under Node's permission model, but TailwindCSS included in the default...

PT-2026-89862

Hugo is a static site generator. From v0.161.0, Hugo executes Node tools under Node's permission model, but TailwindCSS — included in the default security.exec.allow list — requires a highly permissive configuration --allow-addons, --allow-child-process, --allow-worker. As a result, the...

CVE-2026-89259: Execution with Unnecessary Privileges

Hugo is a static site generator. From v0.161.0, Hugo executes Node tools under Node's permission model, but TailwindCSS — included in the default security.exec.allow list — requires a highly permissive configuration --allow-addons, --allow-child-process, --allow-worker. As a result, the...

Malicious code in tailwindcss-contact-forms (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cc68c81374c5b78e36fea2f599c5e0004ead6e56dfd02b40cec4f73c62193b30 The package presents itself as a Tailwind CSS forms plugin README, repository field, and installation docs are copied verbatim from @tailwindcss/form...

MAL-2026-16124 Malicious code in tailwindcss-contact-forms (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cc68c81374c5b78e36fea2f599c5e0004ead6e56dfd02b40cec4f73c62193b30 The package presents itself as a Tailwind CSS forms plugin README, repository field, and installation docs are copied verbatim from @tailwindcss/form...