CVE-2026-100694

Hugo before 0.166.0 Cross-Site Scripting via text/org

Published Sep 26, 2026 CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Description

Hugo is a static site generator. In versions from v0.56.0 through v0.165.x, content files mapped to the text/org media type are rendered without escaping raw HTML: Org export blocks and @@html:...@@ snippets pass HTML through unescaped, resulting in cross-site scripting (XSS) in the generated site. An attacker who can supply or influence a content file under /content or the output of a content adapter can inject scripts that execute in the browsers of visitors to the affected pages. Only pages whose source file or content-adapter output declares the text/org media type are affected, and sites that fully trust all content sources are not impacted. Version v0.166.0 fixes the issue by introducing a security.allowContent allowlist that denies text/org by default; sites that intentionally author Org Mode content can opt back in with [security] allowContent = ['.*'].

Analysis

Technical impact

The flaw exists in Hugo from v0.56.0 through v0.165.x. Content files tagged with the text/org media type are rendered without escaping raw HTML. Org export blocks and @@html:…@@ snippets are passed directly into the generated site, allowing an attacker who can supply or influence a content file to inject script payloads that execute in visitors’ browsers. This vulnerability maps to CWE‑79 and can be used for stored or reflected cross‑site scripting attacks that compromise the user session.

Affected Systems

All installations of the Hugo static site generator released between version 0.56.0 and 0.165.x are affected when they render text/org media types. The bug does not impact sites that never use the text/org media type or that only trust fully trusted content sources. The affected product is the GoHugo Hugo static site generator, with the affected range explicitly enumerated by the CNA.

Risk and Exploitability

The CVSS score of 5.1 indicates a moderate severity, and the vulnerability is not listed in the CISA KEV catalog. The EPSS score is not available, suggesting a limited likelihood of active exploitation at this time. Sites that permit content authors to create or modify files with the text/org media type remain at risk, but upgrading to v0.166.0 or enforcing the default allowlist substantially mitigates the threat.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

gohugoio

hugo

unaffected

Version	Status	Constraints
`0.56.0`	affected	< 0.166.0
`0.166.0`	unaffected	—

Configuration 1 [-]

cpe:2.3:a:gohugo:hugo:*:*:*:*:*:*:*:*

Package	CPE	Advisory	Released Date
Red Hat Hardened Images
hugo-main-0.166.0-0.1.hum1	cpe:/a:redhat:hummingbird:1	RHSA-2026:66266	2026-09-09T00:00:00Z

Vendor Product Versions

Gohugo

Hugo

Version	Status	Scheme	Platform
`[0.56.0,0.166.0)`	affected	semver	—
`0.166.0`	unaffected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade Hugo to version 0.166.0 or later.
If an upgrade is not immediately possible, configure the site by setting security.allowContent = ['.*'] to allow the text/org media type for trusted authors while it remains denied by default.
Restrict write access to the /content directory and audit or validate content added by external or untrusted sources to prevent insertion of malicious org snippets.

Generated by OpenCVE AI on September 26, 2026 at 16:36 UTC.

Tracking

Advisories

No advisories available

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction Active

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact Low

Subsequent System Integrity Impact Low

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.188% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://github.com/gohugoio/hugo/security/advisories/GHSA-pq74-mj4h-cjq2
https://nvd.nist.gov/vuln/detail/CVE-2026-100694
https://www.cve.org/CVERecord?id=CVE-2026-100694
https://www.vulncheck.com/advisories/hugo-before-0.166.0-cross-site-scripting-via-text-org

History

Sep 30, 2026 5:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Sep 29, 2026 1:15 PM First appearance in the feed. Affected versions updated. Affected vendors updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
First Time appeared		Redhat Redhat hummingbird
CPEs		cpe:/a:redhat:hummingbird:1
Vendors & Products		Redhat Redhat hummingbird
References		https://nvd.nist.gov/vuln/detail/CVE-2026-100694 https://www.cve.org/CVERecord?id=CVE-2026-100694
Metrics	threat_severity `None`	threat_severity `Moderate`

Sep 26, 2026 1:30 PM Description updated. Title updated. First appearance in the feed. Weaknesses updated. Affected versions updated. Affected vendors updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Hugo is a static site generator. In versions from v0.56.0 through v0.165.x, content files mapped to the text/org media type are rendered without escaping raw HTML: Org export blocks and @@html:...@@ snippets pass HTML through unescaped, resulting in cross-site scripting (XSS) in the generated site. An attacker who can supply or influence a content file under /content or the output of a content adapter can inject scripts that execute in the browsers of visitors to the affected pages. Only pages whose source file or content-adapter output declares the text/org media type are affected, and sites that fully trust all content sources are not impacted. Version v0.166.0 fixes the issue by introducing a security.allowContent allowlist that denies text/org by default; sites that intentionally author Org Mode content can opt back in with [security] allowContent = ['.*'].
Title		Hugo before 0.166.0 Cross-Site Scripting via text/org
First Time appeared		Gohugo Gohugo hugo
Weaknesses		CWE-79
CPEs		cpe:2.3:a:gohugo:hugo::::::::
Vendors & Products		Gohugo Gohugo hugo
References		https://github.com/gohugoio/hugo/security/advisories/GHSA-pq74-mj4h-cjq2 https://www.vulncheck.com/advisories/hugo-before-0.166.0-cross-site-scripting-via-text-org
Metrics		cvssV3_1 `{'score': 6.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'}` cvssV4_0 `{'score': 5.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N'}`