CVE-2026-100694: Hugo Static Site Generator XSS Vulnerability

CVE-2026-100694 Overview

CVE-2026-100694 is a cross-site scripting (XSS) vulnerability in Hugo, the open-source static site generator maintained by gohugo. Versions v0.56.0 through v0.165.x render content files mapped to the text/org media type without escaping raw HTML. Org export blocks and @@html:...@@ snippets pass HTML through unescaped, allowing script injection into generated pages. An attacker who can supply or influence a content file under /content or the output of a content adapter can execute scripts in the browsers of site visitors. The issue is tracked under [CWE-79] and resolved in Hugo v0.166.0.

Critical Impact
Attackers who control any Org Mode content source can inject arbitrary JavaScript into published Hugo sites, leading to session theft, credential harvesting, or drive-by redirection against site visitors.

Affected Products

Hugo v0.56.0 through v0.165.x
Sites consuming untrusted text/org content files under /content
Sites using content adapters that emit text/org output

Discovery Timeline

2026-09-26 - CVE-2026-100694 published to the National Vulnerability Database (NVD)
2026-09-30 - Last updated in NVD database

Technical Details for CVE-2026-100694

Vulnerability Analysis

Hugo processes multiple markup formats, including Org Mode files identified by the text/org media type. The vulnerable rendering path emits HTML from Org export blocks and inline @@html:...@@ snippets without applying output escaping. This design choice treats Org-sourced HTML as trusted, which breaks when any portion of the content pipeline accepts third-party input.

Exploitation requires that the generated site serve a page whose source file or content-adapter output declares the text/org media type. Sites that fully control all content sources are not affected. However, projects that accept community contributions, consume external feeds through content adapters, or allow user-submitted posts are exposed.

Successful injection yields stored XSS in the published site. Scripts execute in every visitor's browser under the site's origin, enabling cookie theft, authenticated-session abuse, phishing overlays, and redirection to attacker-controlled infrastructure.

Root Cause

The root cause is missing output sanitization in the Org Mode renderer. Hugo's handler for the text/org media type passes raw HTML from #+BEGIN_EXPORT html blocks and @@html:...@@ inline markers directly into the final document without encoding or allowlist filtering. The default configuration prior to v0.166.0 enabled this rendering path for any file matching the text/org media type.

Attack Vector

An attacker crafts an Org Mode file containing an export block or inline HTML snippet that embeds a <script> payload. The file is placed in the /content directory through a pull request, a content adapter fetching remote data, or any pipeline that trusts third-party sources. When Hugo builds the site, the payload is embedded verbatim into the output HTML and served to every visitor. Exploitation requires user interaction (visiting the page) but no authentication on the target site.

No public proof-of-concept exploit or CISA KEV listing is associated with CVE-2026-100694 at this time. See the GitHub Security Advisory GHSA-pq74-mj4h-cjq2 and the VulnCheck advisory for additional technical context.

Detection Methods for CVE-2026-100694

Indicators of Compromise

Presence of .org files in /content containing #+BEGIN_EXPORT html blocks or @@html:...@@ inline snippets with <script>, onerror=, or javascript: payloads.
Generated HTML output containing unexpected inline scripts in pages derived from Org Mode sources.
Content-adapter responses emitting text/org media type with embedded HTML tags from untrusted upstream data.

Detection Strategies

Inventory the Hugo version in use with hugo version and flag any installation between v0.56.0 and v0.165.x.
Grep repositories for .org files and search for BEGIN_EXPORT html or @@html: markers originating from external contributors.
Review the site configuration for the absence of a security.allowContent allowlist, which indicates the pre-v0.166.0 default behavior.

Monitoring Recommendations

Enable Content Security Policy (CSP) reporting on published sites to surface unexpected inline script execution.
Audit CI/CD build logs for Hugo version pinning and alert on builds using versions earlier than v0.166.0.
Monitor pull requests and content-adapter data feeds for .org files or text/org payloads before they merge into the content pipeline.

How to Mitigate CVE-2026-100694

Immediate Actions Required

Upgrade Hugo to v0.166.0 or later across all build environments, developer workstations, and CI/CD pipelines.
Audit /content and all content adapters for existing Org Mode files that may already contain injected HTML.
Rebuild and redeploy all affected sites after upgrading to purge previously generated malicious output.

Patch Information

Hugo v0.166.0 fixes the vulnerability by introducing a security.allowContent allowlist that denies the text/org media type by default. Sites that intentionally author Org Mode content from fully trusted sources can opt back in explicitly. Patch details are published in the GitHub Security Advisory GHSA-pq74-mj4h-cjq2.

Workarounds

Remove or convert all .org content files to Markdown before building if upgrading is not immediately possible.
Disable content adapters that emit text/org media type output from untrusted sources.
Deploy a strict Content Security Policy on the generated site to limit the impact of inline script execution.

bash

# Hugo configuration example (hugo.toml) - opt-in for trusted Org Mode content only
[security]
  allowContent = ['.*']