Log in Start free

Vulnerability · Published Jul 6, 2026 · Assigned by GitHub_M

CVE-2026-50133Hugo: XSS via text/html content files

Medium 5.1

In plain English

A medium-severity cross-site scripting in hugo from gohugoio. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 26% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)5.1Medium
Exploit odds (30 days)0.3%top 74.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Hugo is a static site generator. Prior to 0.162.0, Hugo accepts content files in several markup formats. Files mapped to the text/html media type (typically .html files under /content, or pages produced by a content adapter that sets content.mediaType = "text/html") had their body emitted verbatim into the rendered page. A site that ingests HTML content from an untrusted source could therefore be served stored cross-site scripting. This vulnerability is fixed in 0.162.0.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12hugono fix listedDEBIAN-CVE-2026-50133
Debian:13hugono fix listedDEBIAN-CVE-2026-50133
Debian:14hugo0.162.1-1DEBIAN-CVE-2026-50133
Gogithub.com/gohugoio/hugo0.162.0GHSA-c54g-xjwj-8g82
Gogithub.com/gohugoio/hugo0.162.0GO-2026-5313
Ubuntu:22.04:LTShugono fix listedUBUNTU-CVE-2026-50133
Ubuntu:25.10hugono fix listedUBUNTU-CVE-2026-50133
Ubuntu:26.04:LTShugono fix listedUBUNTU-CVE-2026-50133
Ubuntu:26.10hugono fix listedUBUNTU-CVE-2026-50133

Affected products (as reported)

VendorProductVersions
gohugoio hugo < 0.162.0

Weakness: CWE-79 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

References