The vulnerability lies in Hugo's handling of Node-based asset pipelines. Starting with 0.162.0, Hugo automatically grants TailwindCSS the '--allow-child-process' flag when running under its security exec allow list. TailwindCSS loads the site’s tailwind.config.js via require; any top‑level code in that file runs inside the privileged Node process and can spawn arbitrary child processes. The spawned process, not being governed by the Node permission model, inherits full build‑time privileges and can execute shell commands. This turns a confined file‑access restriction into an arbitrary command‑execution capability for malicious Tailwind configurations.

The affected product is the Hugo static‑site generator from the gohugoio project. Versions 0.162.0 through 0.164.x contain the flaw. Any installation that enables TailwindCSS during the build—such as themes, modules, or starter templates that provide a tailwind.config.js file—is vulnerable. Versions 0.165.0 and later have removed TailwindCSS from the default security.exec.allow list, eliminating the issue.

The CVSS score of 9.3 denotes high severity. No EPSS data is published, and the vulnerability is not listed in the CISA KEV catalog, suggesting limited public exploitation at this time. Nevertheless, the attack is straightforward for an adversary who can contribute or modify the site's build content: by inserting a malicious tailwind.config.js file, an attacker can cause Hugo to spawn a shell with full build‑user privileges, providing remote code execution without further privilege escalation or network connectivity.