Hugo EUVD-2026-87667

Exploitation requires that the affected page's source file or content-adapter output declares the text/org media type (Org Mode content) - Org export blocks and @@html:...@@ snippets are the specific injection vectors. The attacker must be able to supply or influence a content file under /content or the output of a content adapter, i.e. at least author/contributor-level control over content sources. Limiting factors: sites that fully trust all their content sources are explicitly not impacted (single-author or fully-vetted-content sites); a visitor must load the poisoned page (UI:A/UI:R); and after v0.166.0 the security.allowContent allowlist denies text/org by default, so patched sites are unaffected unless they explicitly opt back in with [security] allowContent = ['.*']. Non-Org sites are not exposed at all.

This is a genuine but modest-priority stored XSS in Hugo's Org Mode rendering path. All exploitation-probability signals are quiet: no CISA KEV listing, no EPSS score supplied, and no public POC - so per available data this is 'no public exploit identified at time of analysis,' not active exploitation. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N, score 5.1) is internally consistent with a client-side XSS: no impact to the vulnerable system itself (VC/VI/VA:N) but Low confidentiality/integrity impact to the subsequent system (SC:L/SI:L) - the visitor's browser - and required user interaction (UI:A, a visitor loading the page). The one signal worth contesting is PR:N: exploitation requires the attacker to supply or influence a /content file or content-adapter output, which is effectively author/contributor-level write access to the site source, so a PR:L framing is more defensible (reflected in my assessed vectors). The medium CVSS is not inflated - but it is not urgent either: impact is confined to script execution in visitors' browsers, gated on a non-default content type (text/org) and an untrusted-content authoring model. Overall a real defense-in-depth fix rather than a fire-drill; prioritize on sites that ingest Org Mode content from partially-trusted contributors or content adapters.

A multi-author Hugo site (or one using a content adapter pulling from an external source) accepts an Org Mode (.org / text/org) content file from a partially-trusted contributor. The attacker embeds an Org export block or an @@html:<script>...@@ snippet, which Hugo renders unescaped into the published HTML, so the script executes in the browser of every visitor to that page (session/cookie theft, defacement, drive-by actions). No public exploit code is identified, but the injection technique is trivial and documented in the advisory.