Linux/Unix 主機上安裝了一個或多個受到弱點影響的套件，且廠商未提供可用的修補程式。

  - Hugo 0.161.0 將 Node 資產管線放在 Node.js 權限模型後面，這樣透過 PostCSS、Babel 或 TailwindCSS 執行的程式碼就無法到達專案目錄之外的檔案系統。Hugo 0.162.0 將 tailwindcss 新增至 config/security/securityConfig.go 中的 AllowChildProcess 預設值，這使得每當啟動的工具名為 tailwindcss 時，common/hexec/exec.go 中的 nodePermissionArgs 都會附加 --allow-child-process 。TailwindCSS 會在啟動時透過 require 載入網站的tailwind.config.js，因此該檔案中的頂層程式碼會在允許的節點進程內執行，並可以呼叫 child_process 來產生殼層。產生的處理程序不是節點處理程序，且不會繼承任何權限旗標，因此會以執行建置之帳戶的完整權限執行。因此，建置其主題、模組或入門範本提供 Tailwind 設定的網站會產生任意命令執行，而不是引入權限模型來強制執行的限制檔案存取。Hugo 0.165.0 從預設的 security.exec.allow 清單中移除 tailwindcss，因此該工具不再在預設設定下啟動。（CVE-2026-75926）

請注意，Nessus 的判定取決於廠商所報告的套件是否存在。

Linux/Unix 主机中安装的一个或多个程序包受到一个漏洞影响，而供应商没有提供补丁程序。

  - Hugo 0.161.0 将 Node 资产管道放置在 Node.js 权限模型后面，这样通过 PostCSS、Babel 或 TailwindCSS 运行的代码无法到达项目目录之外的文件系统。Hugo 0.162.0 将 tailwindcss 添加到 config/security/securityConfig.go 的 AllowChildProcess 默认设置中，这样每当即将启动的工具命名为 tailwindcss 时， --allow-child-process 就会附加 common/hexec/exec.go 中的 nodePermissionArgs。TailwindCSS 在启动时通过 require 加载站点的tailwind.config.js，因此该文件中的顶层代码在许可的节点进程内执行，并可调用 child_process 来生成 shell。生成的进程不是节点进程，并且不继承任何权限标记，因此它以执行构建的帐户的完整权限运行。因此，构建其主题、模块或入门模板提供 Tailwind 配置的站点会产生任意命令执行，而不是引入权限模型来强制实施的受限文件访问。Hugo 0.165.0 将 tailwindcss 从默认 security.exec.allow 列表中删除，因此不再以默认配置启动该工具。（CVE-2026-75926）

请注意，Nessus 依赖供应商报告的程序包是否存在进行判断。

Linux/Unix ホストには、ベンダーが提供するパッチが利用できない脆弱性の影響を受ける複数のパッケージがインストールされています。

  - Hugo 0.161.0 、PostCSS、Babel、または TailwindCSS を通じて実行されているコードがプロジェクトディレクトリ外のファイルシステムに到達できないように、Node アセットパイプラインを Node.js 権限モデルの背後に配置しました。Hugo 0.162.0 、config/security/securityConfig.go の AllowChildProcess デフォルトに tailwindcss を追加しました。これにより、common/hexec/exec.go の nodePermissionArgs は、起動中のツールに tailwindcss という名前が付けられるたびに --allow-child-process 付加されます。TailwindCSS は起動時に require を通じてサイトのtailwind.config.jsをロードするため、そのファイルの最上位コードは許可された Node プロセス内で実行され、child_process を呼び出してシェルを生成できます。生成されたプロセスはノードプロセスではなく、どのアクセス許可フラグも継承しないため、ビルドを実行するアカウントの完全な権限で実行されます。したがって、テーマ、モジュール、またはスターターテンプレートがTailwind構成を提供するサイトを構築すると、権限モデルが導入されたときの強制的な制限されたファイルアクセスではなく、任意のコマンド実行が発生します。Hugo 0.165.0 は、デフォルトの security.exec.allow リストから tailwindcss を削除しているため、ツールはデフォルト構成で起動されなくなります。(CVE-2026-75926)

Nessus は、ベンダーから報告されたパッケージの存在に依存していることに注意してください。

The remote Fedora 45 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-97aa8e408a advisory.

    Update to Hugo 0.169.0, which includes a security fix.

    Menu `pre` and `post` values defined in front matter are no longer rendered as unescaped HTML. Because     front matter is untrusted content, a content contributor could previously inject arbitrary HTML, including     script, into pages that render menu entries. These values are now HTML escaped unless `text/html` is     allowed in `security.allowContent`, and a `warning-menu-pre-post-html-escaped` warning is logged when     markup is escaped. Menu entries defined in the site configuration are not affected.

    This update also requires Go 1.27.0 and continues to build the extended edition with bundled LibSass, so     the package does not depend on a system libsass.

    Release notes: https://github.com/gohugoio/hugo/releases/tag/v0.169.0




Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Hugo 0.161.0 placed the Node asset pipelines behind the Node.js permission model so that code running     through PostCSS, Babel, or TailwindCSS could not reach the file system outside the project directory. Hugo     0.162.0 added tailwindcss to the AllowChildProcess default in config/security/securityConfig.go, which     makes nodePermissionArgs in common/hexec/exec.go append --allow-child-process whenever the tool being     launched is named tailwindcss. TailwindCSS loads the site's tailwind.config.js through require at startup,     so top-level code in that file executes inside the permitted Node process and can call child_process to     spawn a shell. The spawned process is not a Node process and inherits none of the permission flags, so it     runs with the full privileges of the account performing the build. Building a site whose theme, module, or     starter template supplies the Tailwind configuration therefore yields arbitrary command execution rather     than the confined file access the permission model was introduced to enforce. Hugo 0.165.0 removes     tailwindcss from the default security.exec.allow list, so the tool is no longer launched under the default     configuration. (CVE-2026-75926)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-667d0938f0 advisory.

    Update to Hugo 0.165.0, which includes security fixes for several CVEs.

    This release fixes CVE-2026-75926 (Tailwind CSS Node permission model bypass) and CVE-2026-89258 (symlink     confinement bypass), as well as earlier escaping and sandbox issues fixed upstream.

    Fedora 44 provides Go 1.26, and Hugo 0.166.0 and later require Go 1.27.0, so 0.165.0 is the newest release     that can be built for this Fedora release.

    The extended edition is built with bundled LibSass, so the package does not depend on a system libsass.

    Release notes: https://github.com/gohugoio/hugo/releases/tag/v0.165.0



Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-9521359c66 advisory.

    Update to Hugo 0.165.0.

    Fedora 43 provides Go 1.26, and Hugo 0.166.0 and later require Go 1.27.0, so 0.165.0 is the newest release     that can be built for this Fedora release. This update therefore skips 0.167.0 and 0.168.0, neither of     which was published for Fedora 43. It is intended to be the final Hugo update for Fedora 43.

    The extended edition is built with bundled LibSass, so the package does not depend on a system libsass.

    Release notes: https://github.com/gohugoio/hugo/releases/tag/v0.165.0



Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名稱	產品	系列	已發布	已更新	嚴重性
337942	Linux Distros 未修補弱點：CVE-2026-75926	Nessus	Misc.	2026/8/19	2026/11/3	critical
337942	Linux Distros 未修补的漏洞：CVE-2026-75926	Nessus	Misc.	2026/8/19	2026/11/3	critical
337942	Linux Distros のパッチ未適用の脆弱性: CVE-2026-75926	Nessus	Misc.	2026/8/19	2026/11/3	critical
381446	Fedora 45 : hugo (2026-97aa8e408a)	Nessus	Fedora Local Security Checks	2026/11/15	2026/11/15	critical
337942	Linux Distros Unpatched Vulnerability : CVE-2026-75926	Nessus	Misc.	2026/8/19	2026/11/3	critical
381483	Fedora 44 : hugo (2026-667d0938f0)	Nessus	Fedora Local Security Checks	2026/11/15	2026/11/15	critical
381481	Fedora 43 : hugo (2026-9521359c66)	Nessus	Fedora Local Security Checks	2026/11/15	2026/11/15	critical

偵測

搜尋 Plugin

critical

critical

critical

critical

critical

critical

critical