Description

Hugo is a static site generator. In versions from v0.56.0 through v0.165.x, content files mapped to the text/org media type are rendered without escaping raw HTML: Org export blocks and @@html:...@@ snippets pass HTML through unescaped, resulting in cross-site scripting (XSS) in the generated site. An attacker who can supply or influence a content file under /content or the output of a content adapter can inject scripts that execute in the browsers of visitors to the affected pages. Only pages whose source file or content-adapter output declares the text/org media type are affected, and sites that fully trust all content sources are not impacted. Version v0.166.0 fixes the issue by introducing a security.allowContent allowlist that denies text/org by default; sites that intentionally author Org Mode content can opt back in with [security] allowContent = ['.*'].

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.1",
  "pubDate": "2026-09-26T14:16:54.150Z",
  "pubdate": "2026-09-26T14:16:54.150Z",
  "executiveSummary": "Hugo versions v0.56.0 through v0.165.x contain a critical vulnerability where content files parsed as text/org media type fail to sanitize raw HTML content.\nThis flaw facilitates Stored Cross-Site Scripting (XSS) attacks, allowing an attacker to inject arbitrary malicious scripts into the generated static site.\nThe vulnerability specifically targets the Org-Mode rendering engine, which processes '@@html:...@@' snippets and Org export blocks without appropriate escaping.\nAny attacker capable of influencing the contents of files within the /content directory or manipulating the output of a content adapter can execute code in the browsers of end-users visiting the generated site.\nThe risk is significant for sites that ingest third-party content or allow user-contributed posts, as the generated output is served to all site visitors.\nExploitation does not require authentication or elevated privileges if the attacker has write access to the source content or the external data source powering the site.\nThe vulnerability is resolved in v0.166.0, which implements a security.allowContent configuration that defaults to disabling Org-Mode parsing to mitigate risk.",
  "technicalDetails": "The root cause of this vulnerability lies in the improper handling of Org-Mode markup during the site generation process. The Hugo rendering pipeline for text/org files fails to apply necessary HTML sanitization to specific Org-Mode constructs.\nSpecifically, the parser treats '@@html:...@@' snippets and Org export blocks as trusted input, directly injecting the raw contents into the final HTML document without escaping special characters or filtering malicious tags.\nThe attack flow begins when a malicious actor inserts crafted payloads into a source file located in the /content directory or provides a modified output via a content adapter that Hugo subsequently processes as text/org.\nWhen Hugo compiles the site, the insecure rendering logic preserves the embedded HTML payload. Upon site deployment, the browser interprets the malicious script as legitimate content, leading to execution in the security context of the origin site.\nBecause the rendered HTML is statically generated, the payload persists across all instances of the affected page until the source content is modified or the site is rebuilt with a secure version of Hugo.\nAffected versions include all releases from v0.56.0 through v0.165.x. The scope of exposure is limited to sites utilizing the text/org media type, provided that the source content is not fully trusted.\nThe impact of successful exploitation includes, but is not limited to, unauthorized session hijacking, theft of sensitive authentication tokens or cookies, redirection to malicious domains, and defacement of the rendered web page. The payload executes with the privileges of the victim's browser session, bypassing conventional same-origin policy protections due to the script appearing as native content of the hosting site."
}