Loading story…
A high-severity flaw tracked as CVE-2026-75926 allowed arbitrary command execution during Hugo site builds by abusing the static site generator’s Node.js permission model. In affected versions, Hugo added tailwindcss to its default security.exec.allow list and launched it with Node’s --allow-child-process flag; because TailwindCSS loads tailwind.config.js with require, attacker-controlled top-level code in that file could call child_process and spawn commands outside the intended restrictions. A malicious theme, module, or starter template could therefore execute code with the privileges of the user running the build.
See affected versions and whether adversaries are exploiting it.
5 events from the most recent confirmed update back to the earliest known activity.
On August 18, 2026, CVE-2026-75926 was published describing arbitrary command execution during Hugo builds via TailwindCSS bypassing the Node.js permission model in versions 0.162.0 through before 0.165.0. The entry states Hugo 0.165.0 fixes the issue by removing tailwindcss from the default security.exec.allow list.
On August 10, 2026, Hugo committed a change removing tailwindcss from the default security.exec.allow list and updating tests so Tailwind execution must be explicitly opted in via configuration.
On August 9, 2026, Hugo maintainers opened issue #15178 proposing removal of TailwindCSS from the default security.exec.allow list because it required a much more permissive setup than Hugo's stricter default security model intended.
In Hugo 0.162.0, tailwindcss was added to the default AllowChildProcess configuration, causing Hugo to launch it with Node's --allow-child-process flag. This created the condition later described as CVE-2026-75926.
Hugo introduced the Node.js permission model in version 0.161.0 to harden execution security for supported JavaScript tooling such as PostCSS.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
4 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcegithub.com
Open sourcegithub.com
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A high-severity server-side request forgery flaw tracked as **CVE-2026-10582** affects **Hugo 0.91.0 through 0.165.0**. The issue lies in outbound fetches performed by `resources.GetRemote`, where `security.http.urls` validates only the supplied URL text and some canonicalized IPv4 variants, but does not resolve hostnames or verify the destination IP at connection time. That gap allows attacker-controlled hostnames to pass policy checks even if they ultimately resolve to loopback, private-network, or cloud-metadata addresses. If an attacker can influence a URL through front matter, site content, or a CMS field, Hugo’s build process can retrieve internal resources and embed the response into the generated static site, creating a path for data exfiltration through published artifacts. Hugo’s security code already includes SSRF-focused checks such as blocking localhost-style URL patterns, userinfo in URLs, and alternate IPv4 encodings, but the advisory says those protections do not enforce dial-time destination validation. The vulnerability is classified as **CWE-918** and has been scored **7.4 CVSS v3.1** and **8.3 CVSS v4.0**.
Aug 24, 2026
Craft CMS disclosed six vulnerabilities affecting **4.x** and **5.x** releases, including a **critical** remote code execution flaw tracked as `CVE-2026-72781`. The most severe issue affects versions **5.0.0-RC1 through before 5.10.7** and **4.0.0-RC1 through before 4.18.3**, where an authenticated user with control panel access can render a malicious Twig template and execute arbitrary code even when the Twig sandbox is enabled. The flaw stems from Craft marking `ElementInterface` as safe and extending sandbox allowlisting through the class hierarchy to `yii\base\Component`, creating an arbitrary function-call gadget.
Aug 11, 2026
Several server and developer administration tools have disclosed severe code-execution vulnerabilities affecting exposed management functionality. **Termix** reported an authenticated OS command injection in `GET /ssh/file_manager/ssh/resolvePath`, where double-quoted user input allowed shell substitution via ``$(...)`` and backticks, enabling arbitrary commands on the connected remote host under the active SSH account. A separate **Termix** issue, tracked as `CVE-2026-45746`, affected versions prior to **2.3.2** and allowed attackers to tamper with a client-controlled `sessionId` to access other users' active File Manager SSH sessions, potentially leading to unauthorized file operations and remote code execution on another user's VPS. Other disclosures showed similar high-impact flaws in JavaScript-based backends. **DbGate** fixed an RCE in **v7.1.9** after researchers found that `POST /runners/start` and `POST /runners/load-reader` concatenated attacker-controlled values into generated JavaScript executed by a forked Node.js process; in anonymous-auth deployments, the issue could permit **unauthenticated RCE**. **BrowserStack Runner** through **0.9.5** was assigned `CVE-2026-49143` for an unauthenticated RCE in the `/_log` handler, where crafted JSON passed through `vm.runInNewContext()` and `eval()` allowed attackers to escape the sandbox and invoke `child_process` on reachable runner instances.
Jun 29, 2026