{"id":"GO-2026-5313","summary":"Hugo: XSS via text/html content files in github.com/gohugoio/hugo","details":"Hugo: XSS via text/html content files in github.com/gohugoio/hugo","aliases":["CVE-2026-50133","GHSA-c54g-xjwj-8g82"],"modified":"2026-07-07T20:30:13.658319903Z","published":"2026-07-07T16:52:19Z","database_specific":{"review_status":"REVIEWED","url":"https://pkg.go.dev/vuln/GO-2026-5313"},"references":[{"type":"ADVISORY","url":"https://github.com/gohugoio/hugo/security/advisories/GHSA-c54g-xjwj-8g82"},{"type":"FIX","url":"https://github.com/gohugoio/hugo/commit/e41a06447daa3071a01f333fdcec0a5153c3c8d1"},{"type":"WEB","url":"https://github.com/gohugoio/hugo/releases/tag/v0.162.0"}],"affected":[{"package":{"name":"github.com/gohugoio/hugo","ecosystem":"Go","purl":"pkg:golang/github.com/gohugoio/hugo"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.162.0"}]}],"ecosystem_specific":{"imports":[{"symbols":["ContentFactory.ApplyArchetypeFi","ContentFactory.ApplyArchetypeTemplate","ContentFactory.CreateContentPlaceHolder","ContentFactory.SectionFromFilename","DefaultConfig","ExampleConfig","HugoSites.Build","HugoSites.Close","HugoSites.Data","HugoSites.GC","HugoSites.GetContentPage","HugoSites.LogServerAddresses","HugoSites.Pages","HugoSites.PrintProcessingStats","HugoSites.RegularPages","IntegrationTestBuilder.AddFiles","IntegrationTestBuilder.AssertFileContent","IntegrationTestBuilder.AssertFileContentEquals","IntegrationTestBuilder.AssertFileContentExact","IntegrationTestBuilder.AssertFileCount","IntegrationTestBuilder.AssertFileExists","IntegrationTestBuilder.AssertFs","IntegrationTestBuilder.AssertLogContains","IntegrationTestBuilder.AssertLogMatches","IntegrationTestBuilder.AssertNoRenderShortcodesArtifacts","IntegrationTestBuilder.AssertPublishDir","IntegrationTestBuilder.AssertRenderCountContent","IntegrationTestBuilder.AssertRenderCountPage","IntegrationTestBuilder.AssertRenderCountPageBetween","IntegrationTestBuilder.Build","IntegrationTestBuilder.BuildE","IntegrationTestBuilder.BuildPartial","IntegrationTestBuilder.BuildPartialE","IntegrationTestBuilder.Close","IntegrationTestBuilder.CreateDirs","IntegrationTestBuilder.EditFileAppend","IntegrationTestBuilder.EditFileReplaceAll","IntegrationTestBuilder.EditFileReplaceFunc","IntegrationTestBuilder.EditFiles","IntegrationTestBuilder.FileContent","IntegrationTestBuilder.ImageHelper","IntegrationTestBuilder.Init","IntegrationTestBuilder.RemoveFiles","IntegrationTestBuilder.RemovePublishDir","IntegrationTestBuilder.RenameDir","IntegrationTestBuilder.RenameFile","IntegrationTestBuilder.SiteHelper","IntegrationTestImageHelper.AssertFormat","IntegrationTestImageHelper.AssertFrameDurations","IntegrationTestImageHelper.AssertIsAnimated","IntegrationTestImageHelper.AssertLoopCount","IntegrationTestPageHelper.MatrixFromFile","IntegrationTestPageHelper.MatrixFromPageConfig","IntegrationTestSiteHelper.PageHelper","NewHugoSites","NewIntegrationTestBuilder","ShortcodeWithPage.InnerDeindent","ShortcodeWithPage.Position","ShortcodeWithPage.Ref","ShortcodeWithPage.RelRef","Site.AllPages","Site.AllRegularPages","Site.BuildDrafts","Site.Data","Site.Debug","Site.Dimension","Site.GetPage","Site.LanguageCode","Site.Languages","Site.Menus","Site.Pages","Site.Param","Site.RegisterMediaTypes","Site.RegularPages","Site.Sections","Site.SitemapAbsURL","Site.Sites","Site.String","Site.Taxonomies","Test","TestE","TestRunning","cachedContentScope.Content","cachedContentScope.ContentWithoutSummary","cachedContentScope.Fragments","cachedContentScope.FuzzyWordCount","cachedContentScope.Len","cachedContentScope.Plain","cachedContentScope.PlainWords","cachedContentScope.ReadingTime","cachedContentScope.RenderShortcodes","cachedContentScope.RenderString","cachedContentScope.Summary","cachedContentScope.WordCount","contentNodeShifter.DeleteFunc","contentNodeShifter.ForEeachInAllDimensions","contentNodeShifter.ForEeachInDimension","contentNodeShifter.Insert","contentNodeShifter.Shift","contentNodesMap.ForEeachInAllDimensions","contentTreeReverseIndex.Get","helperContentNode.GetIdentity","hookRendererTemplate.RenderBlockquote","hookRendererTemplate.RenderCodeblock","hookRendererTemplate.RenderHeading","hookRendererTemplate.RenderLink","hookRendererTemplate.RenderPassthrough","hookRendererTemplate.RenderTable","hookRendererTemplate.ResolvePosition","hugoSitesSitesProvider.Data","lockingBuffer.ReadFrom","pageCommon.Scratch","pageCommon.Store","pageContentOutput.Content","pageContentOutput.ContentWithoutSummary","pageContentOutput.Fragments","pageContentOutput.FuzzyWordCount","pageContentOutput.Len","pageContentOutput.Markup","pageContentOutput.ParseAndRenderContent","pageContentOutput.ParseContent","pageContentOutput.Plain","pageContentOutput.PlainWords","pageContentOutput.ReadingTime","pageContentOutput.Render","pageContentOutput.RenderContent","pageContentOutput.RenderShortcodes","pageContentOutput.RenderString","pageContentOutput.Summary","pageContentOutput.TableOfContents","pageContentOutput.Truncated","pageContentOutput.WordCount","pageMap.AddFi","pageMap.CreateSiteTaxonomies","pageMenus.HasMenuCurrent","pageMenus.IsMenuCurrent","pageMenus.Menus","pageMetaSource.String","pageMetaSource.initFrontMatter","pagePaginator.Paginate","pagePaginator.Paginator","pagePosition.Next","pagePosition.Prev","pagePositionInSection.NextInSection","pagePositionInSection.PrevInSection","pageRef.Ref","pageRef.RefFrom","pageRef.RelRef","pageRef.RelRefFrom","pageSiteAdapter.GetPage","pageState.AllTranslations","pageState.ApplyFilterToHeadings","pageState.Eq","pageState.GetTerms","pageState.Group","pageState.IsTranslated","pageState.MarshalJSON","pageState.Pages","pageState.Param","pageState.RawContent","pageState.RegularPages","pageState.RegularPagesRecursive","pageState.RelatedKeywords","pageState.Resources","pageState.Rotate","pageState.Slice","pageState.Translations","pageTree.Ancestors","pageTree.CurrentSection","pageTree.FirstSection","pageTree.InSection","pageTree.Parent","pageTree.Sections","pageTree.SectionsEntries","pageTree.SectionsPath","pageTrees.DeletePageAndResourcesBelow","pagesCollector.Collect","resourceSource.GetIdentity","resourceSource.String","shortcode.String","taxonomiesConfig.Values"],"path":"github.com/gohugoio/hugo/hugolib"}]},"database_specific":{"source":"https://vuln.go.dev/ID/GO-2026-5313.json"}}],"schema_version":"1.7.5"}