CyberRota Analysis
AI-GeneratedHugo, a static site generator, is vulnerable to stored cross-site scripting (XSS) when processing HTML content from untrusted sources prior to version 0.162.0, allowing attackers to inject malicious scripts that are executed in users' browsers. Organizations using affected versions of Hugo should prioritize upgrading to 0.162.0 or later to mitigate the risk of XSS attacks on their websites.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Hugo is a static site generator. Prior to 0.162.0, Hugo accepts content files in several markup formats. Files mapped to the text/html media type (typically .html files under /content, or pages produced by a content adapter that sets content.mediaType = "text/html") had their body emitted verbatim into the rendered page. A site that ingests HTML content from an untrusted source could therefore be served stored cross-site scripting. This vulnerability is fixed in 0.162.0.
Related CVEs
Other vulnerabilities affecting the same vendor(s)