Hugo is a static site generator. Prior to 0.162.0, Hugo accepts content files in several markup formats. Files mapped to the text/html media type (typically .html files under /content, or pages produced by a content adapter that sets content.mediaType = "text/html") had their body emitted verbatim into the rendered page. A site that ingests HTML content from an untrusted source could therefore be served stored cross‑site scripting. This vulnerability is fixed in 0.162.0. Because the content is emitted without sanitization, an attacker who supplies or modifies such a file can embed malicious scripts that execute in any visitor's browser, enabling a stored cross‑site scripting attack.

All releases of Hugo by gohugoio prior to version 0.162.0 are vulnerable; releases 0.162.0 and later include the fix.

The CVSS score of 5.1 indicates moderate severity. The EPSS score of <1% suggests a very low but nonzero exploitation probability, and the issue is not listed in CISA KEV. Based on the description, it is inferred that an attacker would need to supply or modify a file that Hugo processes as text/html, such as an .html file under /content, or by configuring a content adapter to output that media type. Once the site is built, the embedded script runs in the browser of any visitor, providing the attacker with a stored cross‑site scripting vector.