The flaw exists in Hugo from v0.56.0 through v0.165.x. Content files tagged with the text/org media type are rendered without escaping raw HTML. Org export blocks and @@html:…@@ snippets are passed directly into the generated site, allowing an attacker who can supply or influence a content file to inject script payloads that execute in visitors’ browsers. This vulnerability maps to CWE‑79 and can be used for stored or reflected cross‑site scripting attacks that compromise the user session.

All installations of the Hugo static site generator released between version 0.56.0 and 0.165.x are affected when they render text/org media types. The bug does not impact sites that never use the text/org media type or that only trust fully trusted content sources. The affected product is the GoHugo Hugo static site generator, with the affected range explicitly enumerated by the CNA.

The CVSS score of 5.1 indicates a moderate severity, and the vulnerability is not listed in the CISA KEV catalog. The EPSS score is not available, suggesting a limited likelihood of active exploitation at this time. Sites that permit content authors to create or modify files with the text/org media type remain at risk, but upgrading to v0.166.0 or enforcing the default allowlist substantially mitigates the threat.