| id: GO-2026-5681 |
| modules: |
| - module: github.com/gohugoio/hugo |
| versions: |
| - introduced: 0.91.0 |
| - fixed: 0.162.0 |
| vulnerable_at: 0.161.1 |
| packages: |
| - package: github.com/gohugoio/hugo/resources/resource_factories/create |
| symbols: |
| - New |
| summary: 'Hugo: security.http.urls allow-list bypass via HTTP redirects in github.com/gohugoio/hugo' |
| cves: |
| - CVE-2026-50134 |
| ghsas: |
| - GHSA-vxgm-5rmg-5w8g |
| references: |
| - advisory: https://github.com/gohugoio/hugo/security/advisories/GHSA-vxgm-5rmg-5w8g |
| - fix: https://github.com/gohugoio/hugo/commit/86fbb0f7a8bbb93e2e916390de9e5a4f24bf9f50 |
| - web: https://github.com/gohugoio/hugo/releases/tag/v0.162.0 |
| source: |
| id: GHSA-vxgm-5rmg-5w8g |
| created: 2026-07-07T00:24:43.671463503-04:00 |
| review_status: REVIEWED |
