medium6.1
CVE-2026-50133
Hugo: XSS via text/html content files
Impact
Hugo is a static site generator. Prior to 0.162.0, Hugo accepts content files in several markup formats. Files mapped to the text/html media type (typically .html files under /content, or pages produced by a content adapter that sets content.mediaType = "text/html") had their body emitted verbatim into the rendered page. A site that ingests HTML content from an untrusted source could therefore be served stored cross-site scripting. This vulnerability is fixed in 0.162.0.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| go | github.com/gohugoio/hugo | < 0.162.0 | 0.162.0 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Gohugo | Hugo | before 0.162.0 |