CVE-2026-50133 Details
Description
Hugo is a static site generator. Prior to 0.162.0, Hugo accepts content files in several markup formats. Files mapped to the text/html media type (typically .html files under /content, or pages produced by a content adapter that sets content.mediaType = "text/html") had their body emitted verbatim into the rendered page. A site that ingests HTML content from an untrusted source could therefore be served stored cross-site scripting. This vulnerability is fixed in 0.162.0.
A stored cross-site scripting vulnerability has been identified in Hugo, a static site generator, in all versions prior to 0.162.0. This issue arises because Hugo allows content files in various markup formats, including HTML. Files designated with the 'text/html' media type, such as certain HTML files under the '/content' directory or pages generated by content adapters that specify 'text/html', were rendered with their body content output verbatim. As a result, sites ingesting HTML from untrusted sources could inadvertently serve malicious scripts.
Users can upgrade to Hugo version 0.162.0 or later, which disallows 'text/html' content files by default. For sites that need to allow HTML content, this can be overridden by adding 'allowContent = ['.*']' to the security configuration.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 7, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| gohugo hugo | < 0.162.0 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 8, 2026 | Initial Analysis | [email protected] |
| Jul 7, 2026 | CVE Modified | CISA-ADP |
| Jul 6, 2026 | New CVE Received | [email protected] |