Threats tagged 'ghsa-98xc-jpvp-56pj'

CVE-2026-100694 is a cross-site scripting (XSS) vulnerability in the Hugo static site generator affecting versions from 0.56.0 up to but not including 0.166.0. The issue arises because content files with the text/org media type are rendered without escaping raw HTML, allowing unescaped HTML to pass through Org export blocks and @@html:...@@ snippets. This can enable an attacker who controls or influences such content files to inject malicious scripts that execute in visitors' browsers. The vulnerability is fixed in version 0.166.0 by introducing a security.allowContent allowlist that denies text/org by default, requiring explicit opt-in for Org Mode content. Only sites that process text/org content are affected, and sites fully trusting their content sources are not impacted.