CVE-2026-50133

Name of the Vulnerable Software and Affected Versions Hugo versions prior to 0.162.0

Description Hugo accepts content files in various markup formats. Files mapped to the text/html media type, such as .html files located under /content or pages generated by a content adapter where content.mediaType is set to text/html, have their body emitted verbatim into the rendered page. This can lead to stored cross-site scripting if the site ingests HTML content from untrusted sources, such as external APIs, CMS-backed editors, or automated import pipelines.

Recommendations Update to version 0.162.0 or later. As a mitigation measure, configure the security.allowContent whitelist to deny text/html by default.