Hugo is a static site generator. Prior to 0.162.0, Hugo accepts content files in several markup formats. Files mapped to the text/html media type (typically .html files under /content, or pages produced by a content adapter that sets content.mediaType = "text/html") had their body emitted verbatim into the rendered page. This omission constitutes a CWE‑79 Cross‑Site Scripting weakness, allowing an attacker who supplies or modifies such a file to embed malicious scripts that run in browsers of site visitors. Because the content is stored and served without sanitization, the vulnerability results in stored cross‑site scripting.

All releases of Hugo by gohugoio prior to version 0.162.0 are vulnerable; releases 0.162.0 and later include the fix.

The CVSS score of 5.1 indicates moderate severity. The EPSS score of <1% suggests a very low but nonzero exploitation probability, and the issue is not listed in CISA KEV. Based on the description, it is inferred that an attacker would need to supply or modify a file that Hugo processes as text/html, such as an .html file under /content, or by configuring a content adapter to output that media type. Once the site is built, the embedded script runs in the browser of any visitor, providing the attacker with a stored cross‑site scripting vector.