CVE-2026-100694: Hugo before 0.166.0 Cross-Site Scripting via text/org
Hugo is a static site generator. In versions from v0.56.0 through v0.165.x, content files mapped to the text/org media type are rendered without escaping raw HTML: Org export blocks and @@html:...@@ snippets pass HTML through unescaped, resulting in cross-site scripting (XSS) in the generated site. An attacker who can supply or influence a content file under /content or the output of a content adapter can inject scripts that execute in the browsers of visitors to the affected pages. Only pages whose source file or content-adapter output declares the text/org media type are affected, and sites that fully trust all content sources are not impacted. Version v0.166.0 fixes the issue by introducing a security.allowContent allowlist that denies text/org by default; sites that intentionally author Org Mode content can opt back in with [security] allowContent = ['.'].
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Hugoto a version that resolves this vulnerability.Fixed in 0.166.0
Event History
Frequently Asked Questions
Which sites are exposed to this issue?
Only generated pages whose source content or content-adapter output declares the text/org media type are affected. Sites that fully trust every content source are not impacted.
What does an attacker need to exploit it?
An attacker must be able to supply or influence a file under /content, or influence content produced by a content adapter. They can use Org export blocks or @@html:...@@ snippets to inject HTML that runs in visitors' browsers.
Are sites protected by default after upgrading?
Version 0.166.0 denies text/org content by default through the security.allowContent allowlist. Sites that intentionally use Org Mode content can re-enable it with [security] allowContent = ['.*'], which permits text/org again.
How can I determine whether my site is affected?
Review content files under /content and content-adapter output for declarations of the text/org media type. On affected versions, inspect those sources for raw HTML in Org export blocks or @@html:...@@ snippets, especially where content can be influenced by untrusted parties.