CVE-2026-100694 in Hugo
Summary
by MITRE • 09/26/2026
Hugo is a static site generator. In versions from v0.56.0 through v0.165.x, content files mapped to the text/org media type are rendered without escaping raw HTML: Org export blocks and @@html:...@@ snippets pass HTML through unescaped, resulting in cross-site scripting (XSS) in the generated site. An attacker who can supply or influence a content file under /content or the output of a content adapter can inject scripts that execute in the browsers of visitors to the affected pages. Only pages whose source file or content-adapter output declares the text/org media type are affected, and sites that fully trust all content sources are not impacted. Version v0.166.0 fixes the issue by introducing a security.allowContent allowlist that denies text/org by default; sites that intentionally author Org Mode content can opt back in with [security] allowContent = ['.*'].
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/26/2026
Hugo, a widely adopted static site generator used for building websites from plain text source files, contains a critical cross-site scripting vulnerability affecting versions ranging from v0.56.0 through v0.165.x. The flaw resides in the rendering engine's handling of content files associated with the text/org media type, which corresponds to Org Mode documents commonly used by technical writers and developers for documentation and note-taking. When Hugo processes these specific file types, it fails to properly sanitize or escape raw HTML contained within export blocks and inline snippets denoted by the @html:...@ syntax. This lack of escaping allows arbitrary HTML markup to pass through directly into the final rendered output without being converted to safe text entities, thereby creating a vector for client-side code injection.
The operational impact of this vulnerability is significant for any Hugo-based site that incorporates user-generated content or untrusted third-party inputs via content adapters located under the /content directory. An attacker who gains the ability to supply or influence these source files can inject malicious JavaScript payloads into the generated pages. When a visitor accesses such an affected page, their browser will execute the injected scripts in the context of the site's domain. This enables potential session hijacking, credential theft, defacement, or further exploitation through drive-by downloads and phishing attacks that appear legitimate because they originate from a trusted source. The vulnerability is strictly limited to pages where the source file explicitly declares the text/org media type, meaning sites relying exclusively on other formats like Markdown are not directly susceptible unless those formats allow similar unescaped HTML injection mechanisms which may exist independently.
From a threat modeling perspective, this issue aligns with CWE-79, known as Improper Neutralization of Input During Web Page Generation Cross-site Scripting, where the application fails to neutralize special characters before including user input in output. In terms of adversary tactics, this vulnerability facilitates techniques associated with ATT&CK ID T1059, specifically Command and Scripting Interpreter execution via web browsers, allowing attackers to leverage trusted domains for malicious activities while bypassing certain security controls that rely on domain reputation. The risk is particularly acute for sites that do not fully trust all content sources, such as those accepting contributions from external authors or integrating data feeds through content adapters without rigorous validation protocols.
The vulnerability was addressed in Hugo version v0.166.0 by implementing a more robust security model centered around the security.allowContent configuration option. By default, this new mechanism introduces an allowlist approach that denies the text/org media type unless explicitly permitted, thereby preventing the automatic rendering of potentially dangerous Org Mode export blocks and HTML snippets out-of-the-box. This shift from implicit trust to explicit permission ensures that even if malicious content is introduced into the source files, it will not be rendered as executable code by default. For organizations or individuals who legitimately require Org Mode functionality for their documentation workflows, the fix provides a controlled opt-in mechanism via the configuration setting security.allowContent = ['.*'], allowing them to re-enable support while maintaining awareness of the associated risks and ensuring that any such enabled content sources are thoroughly vetted before publication.