CVE-2026-50133: Stored XSS in Hugo Static Site Generator – Patch to 0.162.0

Technical summary

The vulnerability stems from Hugo's content rendering pipeline. Files with a media type of text/html bypass the normal templating and escaping mechanisms. When such content is processed, Hugo passes the raw HTML directly into the rendered page output. An attacker controlling or influencing content files—through a compromised editor account, a vulnerable upload mechanism, or a supply chain compromise—can craft malicious HTML containing embedded JavaScript. Since Hugo is a static site generator, the XSS payload becomes baked into every served page, affecting all visitors regardless of when they access the site. The CWE-79 classification confirms this as a cross-site scripting defect. The vulnerability requires user interaction (page visit) and network access, but no authentication, making it broadly exploitable by anyone who can publish content to an affected site.

Business impact

For organizations running Hugo-powered sites, this vulnerability could result in credential theft from site visitors, malware distribution, defacement, or phishing attacks conducted at scale. Because the payload is stored in static files, it persists across deployments and remains effective until the site is rebuilt and redeployed. Editorial teams, content networks, documentation sites, and blog platforms using Hugo are at particular risk if they accept content from multiple contributors or external sources. The remediation requires updating Hugo and rebuilding the site, which may disrupt publishing workflows.

Affected systems

Hugo versions prior to 0.162.0 are affected. Any Hugo site ingesting HTML content files from untrusted or semi-trusted sources faces exposure. This includes: content management workflows with multiple editors, sites using content adapters that output text/html media type, documentation generators, and Hugo instances processing user-submitted content or content from third-party data sources.

Exploitability

The vulnerability is straightforward to exploit if an attacker can write or modify content files. No special tools, privilege escalation, or authentication bypass is required beyond the ability to contribute content. The CVSS score of 6.1 reflects this: the attack is over the network, requires no privileges or authentication to set up, but does require user interaction (a visitor accessing the affected page). In supply-chain or insider-threat scenarios, exploitability is near-trivial. External exploitation depends on the target site's content submission and editorial controls.

Remediation

Upgrade Hugo to version 0.162.0 or later. After upgrading, rebuild and redeploy the affected site to regenerate all static pages. Sites that accept HTML content from untrusted sources should additionally review and sanitize existing HTML content files before rebuilding, or consider disabling direct HTML content submission and using a safer markup format instead. Content adapters should avoid setting mediaType = "text/html" for user-supplied content.

Patch guidance

Update Hugo to 0.162.0 or later via your package manager, container image repository, or from the official Hugo release channels. Verify the new version is in use by running `hugo version`. Rebuild the entire site after updating to ensure all pages are regenerated. For sites with automated deployment pipelines, update the Hugo version pin in your build configuration and redeploy. Organizations using Hugo in CI/CD should update the build container or dependency manifest to pull Hugo 0.162.0 or newer.

Detection guidance

Review Hugo configuration files for any content adapters that set mediaType = "text/html" and audit what content they process. Search the /content directory for .html files and assess their origin and trustworthiness. In version control history, look for HTML content files added by unexpected contributors or from untrusted sources around the time of suspected compromise. Monitor site traffic and user reports for unusual behavior or phishing attempts that may indicate stored XSS exploitation. After patching, re-scan previously generated HTML output for embedded script tags or suspicious event handlers.

Why prioritize this

While the CVSS score is moderate (6.1), the practical risk depends on content source trust. Sites accepting HTML from external users or multiple editors should treat this as high priority. The attack is pre-authentication, persistent across page loads, and difficult for visitors to detect. Conversely, sites that tightly control HTML content authorship face lower risk but should still update to eliminate the exposure vector entirely.

Risk score, explained

CVSS 3.1 score of 6.1 (MEDIUM) reflects: network-accessible attack surface (AV:N), low attack complexity with no special conditions (AC:L), no privilege or authentication required (PR:N), user interaction needed for exploitation (UI:R), and cross-site scope (S:C). The impact is confidentiality and integrity compromise (C:L/I:L) with no availability impact. The score appropriately captures that while exploitation is feasible and impact is real, it requires either attacker control of content or user interaction, preventing a higher severity rating.

Frequently asked questions