CVE-2026-50133: Gohugo Hugo Stored XSS Vulnerability

CVE-2026-50133 Overview

CVE-2026-50133 is a stored cross-site scripting (XSS) vulnerability in Hugo, a widely used static site generator written in Go. Versions prior to 0.162.0 emit the body of any content file mapped to the text/html media type verbatim into rendered pages. This behavior affects .html files placed under /content and pages produced by a content adapter that sets content.mediaType = "text/html". Sites that ingest HTML content from untrusted sources therefore serve attacker-controlled script to visitors. The maintainers fixed the issue in Hugo 0.162.0 by denying text/html content by default via the security allowlist [CWE-79].

Critical Impact
Attackers who can influence Hugo content sources can inject persistent JavaScript that executes in every visitor's browser session.

Affected Products

Gohugo Hugo versions prior to 0.162.0
.html content files under the /content directory
Pages generated by content adapters that set content.mediaType = "text/html"

Discovery Timeline

2026-07-06 - CVE-2026-50133 published to NVD
2026-07-08 - Last updated in NVD database

Technical Details for CVE-2026-50133

Vulnerability Analysis

Hugo supports multiple markup formats for content files, including Markdown, AsciiDoc, and HTML. When Hugo encounters a file whose media type resolves to text/html, it treats the body as pre-rendered output and passes it directly to the page template without sanitization or escaping. This behavior is intentional for trusted authors but becomes a stored XSS sink when a site ingests HTML from untrusted contributors, third-party APIs, or user-generated content pipelines. The rendered site persists the injected payload, and every subsequent visitor executes the attacker's JavaScript in the origin of the deployed site.

Root Cause

The root cause lies in Hugo's default security configuration, which did not restrict which content media types could be processed. In hugolib/page.go, content flagged as html was routed through a converter that emitted the raw body. No allowlist gated file-based HTML pages at front matter initialization, so any HTML input reached the renderer unchanged.

Attack Vector

An attacker who can submit or modify a content file — through a Git pull request, a headless CMS integration, or a content adapter fed by an external API — places malicious HTML containing <script> tags or event handlers into the source. When Hugo builds the site, the payload is embedded in the generated page. Visitors to the deployed site trigger the script, enabling session theft, credential harvesting, or drive-by redirection.

// Security patch in config/security/securityConfig.go
// Disallow HTML content by default
			AllowChildProcess: []string{"tailwindcss"}, // detect-libc spawns getconf on some Linux setups.
		},
	},
	// Content under /content is treated as untrusted. text/html bodies are
	// emitted verbatim and are an XSS sink, so they are denied by default.
	// Everything else is allowed because Whitelist treats a deny-only list as
	// "allow anything not denied".
	AllowContent: MustNewWhitelist("! ^text/html$"),
}

// Config is the top level security config.

Source: Hugo commit e41a064

// Security patch in hugolib/page.go
		markup := ps.m.pageConfigSource.ContentMediaType.SubType

		if markup == "html" {
			// Only reachable for shortcode inner content rendering; file-based
			// HTML pages are gated at initFrontMatter via security.allowContent.
			markup = "markdown"
		}
		ps.contentConverter, err = ps.m.newContentConverter(ps, markup)

Source: Hugo commit e41a064

Detection Methods for CVE-2026-50133

Indicators of Compromise

Presence of .html files under the /content directory in Hugo source repositories that were not authored by trusted maintainers.
Content adapter configurations setting content.mediaType = "text/html" on data sourced from external APIs.
Rendered pages containing inline <script> tags, onerror, onload, or other event-handler attributes that did not originate from templates.
Unexpected outbound requests to third-party domains from visitor browsers after a site build.

Detection Strategies

Audit the Hugo project repository for any content files with the .html extension and confirm each is from a trusted source.
Grep build output (public/) for suspicious script payloads before deployment: grep -r "<script" public/.
Enforce Content Security Policy (CSP) response headers on the deployed site to detect and block unexpected script execution.
Review Hugo version strings across CI/CD pipelines and identify installations below 0.162.0.

Monitoring Recommendations

Add CSP violation reporting endpoints and alert on inline-script violations from the production site.
Monitor Git activity for new .html files added to /content and require code review before merge.
Track Hugo dependency versions in software bill of materials (SBOM) tooling and flag builds using vulnerable releases.

How to Mitigate CVE-2026-50133

Immediate Actions Required

Upgrade Hugo to version 0.162.0 or later across all build environments, developer workstations, and CI/CD runners.
Rebuild and redeploy all sites that previously ingested HTML content from untrusted or semi-trusted sources.
Audit /content directories and content adapters for any text/html payloads and validate their provenance.
Rotate any credentials or session tokens that may have been exposed by stored XSS on production sites.

Patch Information

The fix is available in Hugo 0.162.0. See the GitHub Security Advisory GHSA-c54g-xjwj-8g82 and the Hugo v0.162.0 release notes. The patch adds AllowContent: MustNewWhitelist("! ^text/html$") to the default security configuration, denying text/html content processing unless explicitly permitted by site configuration.

Workarounds

If upgrading is not immediately possible, remove all .html files from the /content directory and convert them to Markdown.
Disable or restrict content adapters that set content.mediaType = "text/html" from untrusted data sources.
Deploy a strict Content Security Policy that blocks inline scripts and unauthorized external script sources.
Sanitize HTML input at ingestion using a well-maintained library before writing content files to disk.

bash

# Configuration example: explicitly deny text/html content in Hugo security config
# hugo.toml
[security]
  allowContent = ['! ^text/html$']

# Verify installed Hugo version meets or exceeds the patched release
hugo version | grep -E "v0\.(1[6-9][2-9]|[2-9][0-9]{2,})"