---
id: CVE-2026-50133
title: 'Hugo: XSS via text/html content files'
summary: 'Hugo: XSS via text/html content files'
severity: medium
cwe:
  - CWE-79
vendor: gohugoio
product: github.com/gohugoio/hugo
ecosystem: go
affected:
  - github.com/gohugoio/hugo < 0.162.0
patched:
  - github.com/gohugoio/hugo 0.162.0
published: '2026-06-16'
updated: '2026-06-16'
source: GHSA
sourceUrl: 'https://github.com/advisories/GHSA-c54g-xjwj-8g82'
references:
  - url: 'https://github.com/gohugoio/hugo/security/advisories/GHSA-c54g-xjwj-8g82'
  - url: >-
      https://github.com/gohugoio/hugo/commit/e41a06447daa3071a01f333fdcec0a5153c3c8d1
  - url: 'https://github.com/gohugoio/hugo/releases/tag/v0.162.0'
  - url: 'https://github.com/advisories/GHSA-c54g-xjwj-8g82'
tags:
  - ghsa
  - go
ingestedAt: '2026-06-29T14:31:47.706Z'
epss: 0.00327
epssPercentile: 0.23033
---

## Overview

**Commit:** [e41a06447d](https://github.com/gohugoio/hugo/commit/e41a06447d) — _Disallow HTML content by default_
**Affected versions:** all Hugo versions prior to v0.162.0.
**Fixed in:** v0.162.0.
**Severity:** Low to Medium, depending on threat model. Not an issue if you fully trust every file under `/content` and every content adapter you load.

**Description.** Hugo accepts content files in several markup formats. Files mapped to the `text/html` media type (typically `.html` files under `/content`, or pages produced by a content adapter that sets `content.mediaType = "text/html"`) had their body emitted verbatim into the rendered page. A site that ingests HTML content from an untrusted source — for example, a CMS-backed editor, a content adapter pulling from an external API, or an automated import pipeline — could therefore be served stored cross-site scripting.

**Mitigation.** v0.162.0 introduces a `security.allowContent` whitelist with `text/html` denied by default. Sites that intentionally author HTML content can opt back in:

```toml
[security]
allowContent = ['.*']
```

This only affects pages whose source file (or content adapter output) declares an HTML media type; Markdown, AsciiDoc, Org, Pandoc and reStructuredText content is unaffected.

## Affected packages

- `github.com/gohugoio/hugo < 0.162.0`

## Remediation

Upgrade to a patched release:

- `github.com/gohugoio/hugo 0.162.0`