CVE-2026-100694
Received Received - Intake

Cross-Site Scripting in Hugo Static Site Generator

Publication date: 2026-09-26

Last updated on: 2026-09-26

Assigner: VulnCheck

Description
Hugo is a static site generator. In versions from v0.56.0 through v0.165.x, content files mapped to the text/org media type are rendered without escaping raw HTML: Org export blocks and @@html:...@@ snippets pass HTML through unescaped, resulting in cross-site scripting (XSS) in the generated site. An attacker who can supply or influence a content file under /content or the output of a content adapter can inject scripts that execute in the browsers of visitors to the affected pages. Only pages whose source file or content-adapter output declares the text/org media type are affected, and sites that fully trust all content sources are not impacted. Version v0.166.0 fixes the issue by introducing a security.allowContent allowlist that denies text/org by default; sites that intentionally author Org Mode content can opt back in with [security] allowContent = ['.*'].

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-26
Last Modified
2026-09-26
Generated
2026-09-26
AI Q&A
2026-09-26
EPSS Evaluated
N/A
NVD
CVE-2026-100694
EUVD
EUVD-2026-87667

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
gohugoio hugo From 0.56.0 (inc) to 0.165.x (inc)
gohugoio hugo 0.166.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects Hugo, a static site generator. It allows raw HTML in Org Mode content files to be rendered without escaping, enabling cross-site scripting (XSS) attacks. Attackers can inject malicious scripts into pages that use the text/org media type.

Detection Guidance

Check Hugo versions between v0.56.0 and v0.165.x. Inspect content files using text/org media type for raw HTML snippets like @@html:...@@ or Org export blocks. Search for unescaped HTML in generated site output.

Impact Analysis

If you use Hugo versions between v0.56.0 and v0.165.x, an attacker could inject scripts into your site's pages. Visitors to your site may have their browsers compromised, leading to data theft or unauthorized actions. Only sites using Org Mode content are affected.

Compliance Impact

This XSS vulnerability could lead to unauthorized data access or manipulation, violating GDPR's integrity and confidentiality requirements. For HIPAA, it may compromise protected health information integrity. Affected sites must address this to maintain compliance.

Mitigation Strategies

Upgrade Hugo to v0.166.0 or later. If Org Mode content is required, enable it explicitly via [security] allowContent = ['.*'] in config. Otherwise, remove text/org media type usage.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-100694. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart