CVE-2026-100694

Executive Summary

CVE-2026-100694 is a stored cross-site scripting (XSS) vulnerability in Hugo, the Go-based static site generator, affecting versions v0.56.0 through v0.165.x. Content files mapped to the text/org media type are rendered without escaping raw HTML, so Org export blocks and @@html:...@@ snippets pass markup through unescaped into the generated site. An attacker who can supply or influence a content file under /content — or the output of a content adapter — can inject JavaScript that executes in the browsers of visitors to the affected pages, with a CVSS score of 6.1 (Medium).

Technical Analysis

Hugo maps source content files to media types and dispatches them to the appropriate renderer. For files declared as text/org, the Org Mode renderer historically passed raw HTML through without escaping. Two distinct mechanisms are implicated by the vendor description:

1. Org export blocks — Org Mode syntax that explicitly designates embedded HTML. Because Hugo did not sanitize the rendered output, HTML authored inside these blocks was emitted verbatim into the final static page.
2. @@html:...@@ snippets — Org Mode inline export syntax, which likewise passed HTML through unescaped.

The result is that any HTML — including <script> tags, event handlers, or resource-loading elements such as <img onerror=...> or <iframe> — authored through these constructs would be written into the generated HTML without encoding. When a visitor loads the affected page, the injected script executes in the origin of the generated site.

The attack surface is constrained by two conditions stated by the vendor:

• The page's source file or content-adapter output must declare the text/org media type. Pages authored in other formats (e.g., Markdown) are not affected by this specific rendering path, as their renderers apply the expected escaping.
• The site must permit untrusted content to reach the /content directory or be produced by a content adapter. Sites that "fully trust all content sources are not impacted," since there is no adversarial input.

This is a classic CWE-79 (Improper Neutralization of Input During Web Page Generation) instance in a static site generator context. The vulnerability is stored rather than reflected: the malicious payload is persisted in the source content and compiled into static output at build time, meaning the malicious script is served to all visitors of the affected page until the content is removed and the site is rebuilt. There is no public proof-of-concept, no Nuclei template, and no exploit code available in any tracked source at the time of writing.

Exploitation Scenarios

Because no public PoC exists, the attack chain below is described at the vulnerability-class level, strictly following the vendor description. No implementation-specific function, endpoint, or parameter names are invented.

1) Reconnaissance / target identification. An attacker identifies a Hugo-generated site running an affected version (v0.56.0–v0.165.x) that ingests content from sources the attacker can influence — for example, a site that accepts user-contributed content, aggregates content from external repositories via a content adapter, or otherwise does not fully trust all content sources. Publicly reachable static output is often identifiable by generator metadata, directory structure, and build artifacts, but the critical reconnaissance step is establishing write or influence over a /content-bound file or a content adapter's output that will be assigned the text/org media type.

2) Triggering the flaw class. The attacker obtains or supplies a content file whose media type resolves to text/org, or influences the output of a content adapter that produces such content. Because the Org renderer fails to escape raw HTML, any markup the attacker places within Org export blocks or @@html:...@@ snippets is emitted unescaped into the built page.

3) Payload/execution method. At the vulnerability-class level, the attacker embeds arbitrary HTML — script-bearing markup — through the two Org constructs identified by the vendor. There is no server-side request forgery or remote code execution at play: the payload is client-side JavaScript that the static site serves to every visitor. The payload executes in the browser of any user who loads the affected page, in the origin of the generated site.

4) Post-exploitation impact. Executed script runs in the origin of the generated site. From that position an attacker can, at the class level, read and manipulate same-origin content, act on behalf of the site against its visitors, exfiltrate data available to the page, and chain into further browser-based abuse. The precise impact depends on what the site stores or exposes to visitors, hence the CVSS scope-change (S:C) and limited confidentiality/integrity impact (C:L/I:L) with no availability impact (A:N). The UI:R vector reflects that a victim must visit the crafted page for the script to run.

Impact Assessment

The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N (base 6.1, Medium) frames the risk:

• AV:N / AC:L / PR:N — The vulnerability is remotely triggerable over the network with low complexity and no privileges required for the injection, since it depends on the ability to supply or influence content.
• UI:R — A human visitor must load the affected page for the payload to execute.
• S:C — The impact scope crosses a security boundary: script executed in the browser can affect resources beyond the vulnerable component's immediate scope (e.g., other origins or systems the victim's browser can reach).
• C:L / I:L / A:N — Limited confidentiality and integrity impact to the site and its visitors, with no direct availability impact.

Blast radius. Any page in a Hugo project whose source file or content-adapter output is declared as text/org is potentially affected, and every visitor of those pages is exposed for as long as the malicious content remains compiled into the deployed site. Because output is static, a single injected payload may be served to an arbitrary number of visitors without repeated interaction with the build system. Sites that fully trust their content sources are explicitly out of scope — the risk is concentrated in multi-author sites, publishing platforms, and pipelines that ingest external content via content adapters.

Business impact. For an affected site, consequences include credential or session abuse in the site's origin, defacement-like manipulation of on-site content delivered to visitors, and reputational and trust damage. Because the payload persists in static output, remediation requires both removing the content and rebuilding/redeploying the site.

Detection Guidance

Sigma Rule

This rule looks for build-pipeline and server-side evidence of Org content containing raw HTML constructs, which is not directly observable through standard process telemetry. It targets file-creation and build activity correlated with text/org content:

title: Hugo Text/Org Content With Raw HTML Construct Detection
id: 6b1f9c4a-3e7d-4a12-9c55-1f7e2d4b8a03
status: experimental
description: Detects creation or modification of Hugo content or content-adapter
    output that declares the text/org media type and contains raw HTML export
    constructs, consistent with CVE-2026-100694 XSS injection.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-100694
author: threat-intel
date: 2026/01/01
logsource:
    category: file_event
detection:
    selection_path:
        TargetFilename|contains:
            - '/content/'
            - 'content/'
    selection_ext:
        TargetFilename|endswith:
            - '.org'
            - '.txt'
    selection_construct:
        - CommandLine|contains:
            - '@@html:'
            - '#+BEGIN_EXPORT html'
            - '#+begin_export html'
    condition: selection_path and (selection_ext or selection_construct)
falsepositives:
    - Legitimate Org Mode authors intentionally embedding trusted HTML
level: medium
tags:
    - attack.t1059.007
    - cwe.79

YARA Rule

This rule scans content files and built output for the Org raw-HTML constructs that carry the injection payload.

rule CVE_2026_100694_Hugo_Org_RawHTML_XSS
{
    meta:
        author = "threat-intel"
        description = "Detects Hugo text/org content abusing unescaped raw HTML export constructs (CVE-2026-100694)"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-100694"
        date = "2026-01-01"
        severity = "medium"

    strings:
        $org_inline = "@@html:" ascii nocase
        $org_block1 = "#+BEGIN_EXPORT html" ascii nocase
        $org_block2 = "#+begin_export html" ascii nocase
        $script = "<script" ascii nocase
        $handler = "onerror=" ascii nocase
        $handler2 = "onload=" ascii nocase

    condition:
        filesize < 5MB and
        ($org_inline or $org_block1 or $org_block2) and
        ($script or $handler or $handler2)
}

Suricata IDS Rule

This rule inspects HTTP responses from an affected static site for Org-origin raw HTML markers or script tags embedded where the content type or path suggests Org-rendered output. Because the output is static the strongest signal is a script tag adjacent to Org export markers in served HTML.

alert http any any -> any any (msg:"CVE-2026-100694 Hugo text/org raw HTML XSS in served content"; flow:established,to_client; http.response_body; content:"@@html:"; nocase; http.response_body; content:"<script"; nocase; distance:0; reference:cve,2026-100694; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-100694; classtype:web-application-attack; sid:2026100694; rev:1;)

Elastic Detection

This EQL rule detects file events creating or modifying Org content under a content directory.

file where event.action in ("creation", "modification") and
  file.path : ("*content*") and
  file.extension in ("org", "txt")

A supplementary query for command telemetry, where a Hugo build or deployment process is observed operating on newly created Org content, is available by correlating process.name containing hugo with the above file events on the same host.

Splunk SPL Query

This search hunts web-server logs for requests to Org-typed content and for suspicious patterns in served static output where request logging captures paths.

index=web OR index=proxy
| eval path=coalesce(uri_path, url, cs_uri_stem)
| where like(path, "%/content/%") OR match(path, "\\.(org|txt)$")
| stats count min(_time) as first_seen max(_time) as last_seen values(src_ip) as source_ips by path, host
| where count > 0
| sort -count

For deployments that log build artifacts, extend the search to flag .org files containing @@html: or #+BEGIN_EXPORT html followed by script tags in the pipeline audit index.

Wazuh OSSEC Rule

This rule triggers on file integrity monitoring of Hugo content directories, flagging new or changed Org-typed content.

<group name="hugo,cve-2026-100694,web,">
  <rule id="2026106" level="10">
    <decoded_as>syscheck</decoded_as>
    <if_sid>550</if_sid>
    <field name="file">content/</field>
    <description>CVE-2026-100694: Hugo content file created or modified under text/org path</description>
    <mitre>
      <id>T1059.007</id>
    </mitre>
    <group>fim,web_attack,</group>
  </rule>

  <rule id="2026107" level="12">
    <if_sid>2026106</if_sid>
    <field name="file">\.(org|txt)$</field>
    <description>CVE-2026-100694: Hugo text/org source changed - review for embedded raw HTML XSS</description>
    <group>fim,web_attack,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source in our dataset). The vendor description states that v0.166.0 addresses the issue; however, no independently verified patch source (vendor advisory, commit reference, or distribution package) is confirmed in our tracked data, so treat all version guidance as unverified until corroborated against upstream release notes.

1) Immediate mitigations (before upgrade is validated):

• Do not accept or process untrusted content that can be assigned the text/org media type. Restrict write access to /content and to any content-adapter inputs to fully trusted authors/pipelines only.
• For sites that do not intentionally author Org Mode content, deny text/org handling entirely and avoid ingesting content adapters whose output may be declared as Org.
• Require rebuild-and-redeploy after removal of any suspicious Org-typed content, since the vulnerability persists in static output.
• Where feasible, deploy a Content Security Policy (CSP) with a restrictive script-src on the generated site as defense-in-depth against any residual inline execution.

2) Patch/upgrade steps:

• Upgrade Hugo to v0.166.0 or later, which per the vendor introduces a security.allowContent allowlist that denies text/org by default.
• After upgrading, verify the default deny is in effect and only opt back in for trusted Org authoring.
• Rebuild the site and review generated pages to confirm no previously injected raw HTML persists in output.
• Confirm the upgrade via official Hugo release notes before relying on it as the sole remediation, given the 0/4 patch-confidence rating.

3) Long-term hardening:

• Sites that intentionally author Org Mode content can opt back in with [security] allowContent = ['.*'] in their configuration; this broad opt-in should be avoided and replaced with a narrowly scoped allowlist where possible.
• Treat all external content sources as untrusted by default; validate and sanitize before ingestion.
• Adopt a strict CSP and subresource integrity on generated sites to reduce the exploitability of any future output-encoding defects.
• Monitor upstream Hugo security advisories and re-validate this CVE's patch status as independent sources emerge.

References

• NVD — CVE-2026-100694: https://nvd.nist.gov/vuln/detail/CVE-2026-100694
• Hugo project (official site and release notes): https://gohugo.io/
• CWE-79 — Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'): https://cwe.mitre.org/data/definitions/79.html
• FIRST EPSS: not yet scored for this CVE (do not cite a fabricated value).
• CISA KEV: this CVE is not listed in the CISA Known Exploited Vulnerabilities catalog as of this writing.

Exploit-in-the-wild evidence: None available. No public PoC, no Nuclei template, and no exploit code are present in any tracked source; there are no known threat actor campaigns associated with CVE-2026-100694 at the time of writing.