Stored XSS in Hugo Static Site Generator

Executive Summary

CVE-2026-50133 is a stored cross-site scripting (XSS) vulnerability in Hugo, a static site generator. Prior to version 0.162.0, Hugo would emit the body of files mapped to the text/html media type (such as .html files under the /content directory) verbatim into the rendered page. If a site ingests HTML content from an untrusted source, this behavior could allow malicious scripts to be stored and executed in users' browsers.

The vulnerability arises because untrusted HTML content is not sanitized or blocked by default, leading to a potential XSS attack vector.

The issue was fixed in Hugo version 0.162.0 by introducing a security policy that denies text/html content by default unless explicitly allowed via configuration.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact you by allowing attackers to inject malicious HTML or JavaScript into your Hugo-generated site if you accept HTML content from untrusted sources. Such injected scripts could execute in the browsers of your site visitors, potentially leading to theft of cookies, session tokens, or other sensitive information.

The stored XSS could compromise the security and integrity of your website, damage your users' trust, and lead to further attacks such as phishing or malware distribution.

To mitigate this risk, you must upgrade to Hugo 0.162.0 or later, which blocks HTML content by default unless explicitly allowed in the configuration.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves Hugo emitting raw HTML content verbatim into rendered pages when the content is mapped to the text/html media type, which can lead to stored cross-site scripting (XSS). To detect if your system is affected, you should check if your Hugo site is running a version prior to 0.162.0 and if it serves HTML content from untrusted sources under the /content directory or via content adapters.

Since the vulnerability is related to how Hugo processes content files, detection involves inspecting your Hugo version and configuration rather than network traffic. You can verify your Hugo version by running the command:

• hugo version

Additionally, you can search your Hugo configuration file (e.g., hugo.toml) for the presence or absence of the security.allowContent setting that controls whether HTML content is allowed. For example, to check if HTML content is allowed, you can run:

• grep -i allowContent hugo.toml

To detect if your site serves raw HTML content that could be exploited, you might also inspect the rendered pages for unescaped HTML content or test for XSS by reviewing pages that ingest HTML from untrusted sources.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, you should upgrade your Hugo installation to version 0.162.0 or later, where the issue is fixed by default.

If upgrading immediately is not possible, you can configure Hugo to disallow HTML content by default by setting the security.allowContent whitelist in your Hugo configuration file (e.g., hugo.toml) to deny text/html content unless explicitly allowed.

• Upgrade Hugo to version 0.162.0 or later.
• Set or verify the security.allowContent setting to disallow text/html content by default.
• Review and sanitize any HTML content ingested from untrusted sources before including it in your site.

Useful 0 Not Useful 0