5.1

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-50133

CVE-2026-50133: Hugo: XSS via text/html content files

Hugo is a static site generator. Prior to 0.162.0, Hugo accepts content files in several markup formats. Files mapped to the text/html media type (typically .html files under /content, or pages produced by a content adapter that sets content.mediaType = "text/html") had their body emitted verbatim into the rendered page. A site that ingests HTML content from an untrusted source could therefore be served stored cross-site scripting. This vulnerability is fixed in 0.162.0.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-50133

CVE-2026-50133:

5.1

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation NoneAutomatable NoTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/gohugoio/hugo	go	< 0.162.0	0.162.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in Hugo's handling of content files, where files with a text/html media type were rendered without sanitization, creating a stored XSS risk. The root cause was the absence of a security check to control which content types could be rendered as-is. The fix, introduced in commit e41a06447daa3071a01f333fdcec0a5153c3c8d1, implements a security policy (security.allowContent) that denies text/html by default. This policy is enforced within the pageMetaSource.initFrontMatter function in hugolib/page__meta.go. Before the patch, this function would process content regardless of its type. The patch modifies initFrontMatter to call CheckAllowedContent, a new function that validates the media type against the security policy. Therefore, pageMetaSource.initFrontMatter is the critical function in the execution flow that, in vulnerable versions, would initiate the processing of malicious HTML content.

Vulnerable functions

pageMetaSource.initFrontMatter

hugolib/page__meta.go

This function is responsible for initializing the front matter and content of a page. Prior to the patch, it did not perform any security checks on the media type of the content. This allowed content with a 'text/html' media type to be processed and later rendered verbatim, leading to a stored Cross-Site Scripting (XSS) vulnerability. The patch introduces a check within this function to validate the content's media type against a security policy, thus preventing the processing of potentially malicious HTML content by default.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.