Hugo versions >=0.56.0 and <0.166.0 improperly neutralize input during web page generation for content files with the text/org media type. Org export blocks and @@html:...@@ snippets pass raw HTML unescaped, resulting in cross-site scripting (XSS) in the generated site. Attackers able to supply or influence content files or content adapter output with this media type can inject malicious scripts that execute in site visitors' browsers. The vulnerability is addressed in version 0.166.0 by default denying text/org content via a security.allowContent allowlist, with an option to opt back in for sites intentionally using Org Mode content.

An attacker who can supply or influence content files or content adapter output declaring the text/org media type can inject malicious scripts that execute in the browsers of visitors to the affected pages. This can lead to typical XSS impacts such as session hijacking or content manipulation. Sites that fully trust all content sources are not impacted. The vulnerability has a CVSS 4.0 score of 5.1 (medium severity). No known exploits in the wild have been reported.

Upgrade to Hugo version 0.166.0 or later, which fixes the issue by introducing a security.allowContent allowlist that denies text/org content by default. Sites that intentionally use Org Mode content can opt back in by configuring [security] allowContent = ['.*']. No other mitigation is required if the upgrade is applied.