CVE-2026-50133

Hugo is a static site generator. Prior to 0.162.0, Hugo accepts content files in several markup formats. Files mapped to the text/html media type (typically .html files under /content, or pages produced by a content adapter that sets content.mediaType = "text/html") had their body emitted verbatim into the rendered page. A site that ingests HTML content from an untrusted source could therefore be served stored cross-site scripting. This vulnerability is fixed in 0.162.0.

CVSS v3 6.1 MEDIUM

6.1^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://github.com/gohugoio/hugo/commit/e41a06447daa3071a01f333fdcec0a5153c3c8d1	Patch
https://github.com/gohugoio/hugo/releases/tag/v0.162.0	Release Notes
https://github.com/gohugoio/hugo/security/advisories/GHSA-c54g-xjwj-8g82	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:gohugo:hugo:*:*:*:*:*:*:*:*

History

25 Oct 2026, 20:10

Type	Values Removed	Values Added
Summary		(es) Hugo es un generador de sitios estáticos. Antes de la versión 0.162.0, Hugo acepta archivos de contenido en varios formatos de marcado. Los archivos mapeados al tipo de medio text/html (típicamente archivos .html bajo /content, o páginas producidas por un adaptador de contenido que establece content.mediaType = ’text/html’) tenían su cuerpo emitido textualmente en la página renderizada. Un sitio que ingiere contenido HTML de una fuente no confiable podría, por lo tanto, servir cross-site scripting almacenado. Esta vulnerabilidad está corregida en la versión 0.162.0.

Information

Published : 2026-07-06 20:16

Updated : 2026-10-25 20:10

NVD link : CVE-2026-50133

Mitre link : CVE-2026-50133

CVE.ORG link : CVE-2026-50133

JSON object : View

Products Affected

gohugo

hugo

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2026-50133", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-50133", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-07T14:44:22.813847Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.1, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "ACTIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "LOW", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "gohugoio", "product": "hugo", "versions": [{"status": "affected", "version": "< 0.162.0"}]}]}], "published": "2026-07-06T20:16:37.043", "references": [{"url": "https://github.com/gohugoio/hugo/commit/e41a06447daa3071a01f333fdcec0a5153c3c8d1", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/gohugoio/hugo/releases/tag/v0.162.0", "tags": ["Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/gohugoio/hugo/security/advisories/GHSA-c54g-xjwj-8g82", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "Hugo is a static site generator. Prior to 0.162.0, Hugo accepts content files in several markup formats. Files mapped to the text/html media type (typically .html files under /content, or pages produced by a content adapter that sets content.mediaType = \"text/html\") had their body emitted verbatim into the rendered page. A site that ingests HTML content from an untrusted source could therefore be served stored cross-site scripting. This vulnerability is fixed in 0.162.0."}, {"lang": "es", "value": "Hugo es un generador de sitios est\u00e1ticos. Antes de la versi\u00f3n 0.162.0, Hugo acepta archivos de contenido en varios formatos de marcado. Los archivos mapeados al tipo de medio text/html (t\u00edpicamente archivos .html bajo /content, o p\u00e1ginas producidas por un adaptador de contenido que establece content.mediaType = \u2019text/html\u2019) ten\u00edan su cuerpo emitido textualmente en la p\u00e1gina renderizada. Un sitio que ingiere contenido HTML de una fuente no confiable podr\u00eda, por lo tanto, servir cross-site scripting almacenado. Esta vulnerabilidad est\u00e1 corregida en la versi\u00f3n 0.162.0."}], "lastModified": "2026-10-25T20:10:00.147", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:gohugo:hugo:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "04E0F491-D2EB-4F67-B86B-038519EF0728", "versionEndExcluding": "0.162.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}