Medium severity6.1GHSA Advisory· Published Jul 6, 2026· Updated Jul 8, 2026
CVE-2026-50133
CVE-2026-50133
Description
Hugo is a static site generator. Prior to 0.162.0, Hugo accepts content files in several markup formats. Files mapped to the text/html media type (typically .html files under /content, or pages produced by a content adapter that sets content.mediaType = "text/html") had their body emitted verbatim into the rendered page. A site that ingests HTML content from an untrusted source could therefore be served stored cross-site scripting. This vulnerability is fixed in 0.162.0.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
github.com/gohugoio/hugoGo | < 0.162.0 | 0.162.0 |
Affected products
3- osv-coordsRange: < 0.0.20260723T184607-160000.1.1
Patches
Vulnerability mechanics
References
4- github.com/gohugoio/hugo/commit/e41a06447daa3071a01f333fdcec0a5153c3c8d1nvdPatchWEB
- github.com/advisories/GHSA-c54g-xjwj-8g82ghsaADVISORY
- github.com/gohugoio/hugo/security/advisories/GHSA-c54g-xjwj-8g82nvdVendor AdvisoryWEB
- github.com/gohugoio/hugo/releases/tag/v0.162.0nvdRelease NotesWEB
News mentions
0No linked articles in our index yet.