data/osv/GO-2026-5313.json

{
  "schema_version": "1.3.1",
  "id": "GO-2026-5313",
  "modified": "0001-01-01T00:00:00Z",
  "published": "0001-01-01T00:00:00Z",
  "aliases": [
    "CVE-2026-50133",
    "GHSA-c54g-xjwj-8g82"
  ],
  "summary": "Hugo: XSS via text/html content files in github.com/gohugoio/hugo",
  "details": "Hugo: XSS via text/html content files in github.com/gohugoio/hugo",
  "affected": [
    {
      "package": {
        "name": "github.com/gohugoio/hugo",
        "ecosystem": "Go"
      },
      "ranges": [
        {
          "type": "SEMVER",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.162.0"
            }
          ]
        }
      ],
      "ecosystem_specific": {
        "imports": [
          {
            "path": "github.com/gohugoio/hugo/hugolib",
            "symbols": [
              "ContentFactory.ApplyArchetypeFi",
              "ContentFactory.ApplyArchetypeTemplate",
              "ContentFactory.CreateContentPlaceHolder",
              "ContentFactory.SectionFromFilename",
              "DefaultConfig",
              "ExampleConfig",
              "HugoSites.Build",
              "HugoSites.Close",
              "HugoSites.Data",
              "HugoSites.GC",
              "HugoSites.GetContentPage",
              "HugoSites.LogServerAddresses",
              "HugoSites.Pages",
              "HugoSites.PrintProcessingStats",
              "HugoSites.RegularPages",
              "IntegrationTestBuilder.AddFiles",
              "IntegrationTestBuilder.AssertFileContent",
              "IntegrationTestBuilder.AssertFileContentEquals",
              "IntegrationTestBuilder.AssertFileContentExact",
              "IntegrationTestBuilder.AssertFileCount",
              "IntegrationTestBuilder.AssertFileExists",
              "IntegrationTestBuilder.AssertFs",
              "IntegrationTestBuilder.AssertLogContains",
              "IntegrationTestBuilder.AssertLogMatches",
              "IntegrationTestBuilder.AssertNoRenderShortcodesArtifacts",
              "IntegrationTestBuilder.AssertPublishDir",
              "IntegrationTestBuilder.AssertRenderCountContent",
              "IntegrationTestBuilder.AssertRenderCountPage",
              "IntegrationTestBuilder.AssertRenderCountPageBetween",
              "IntegrationTestBuilder.Build",
              "IntegrationTestBuilder.BuildE",
              "IntegrationTestBuilder.BuildPartial",
              "IntegrationTestBuilder.BuildPartialE",
              "IntegrationTestBuilder.Close",
              "IntegrationTestBuilder.CreateDirs",
              "IntegrationTestBuilder.EditFileAppend",
              "IntegrationTestBuilder.EditFileReplaceAll",
              "IntegrationTestBuilder.EditFileReplaceFunc",
              "IntegrationTestBuilder.EditFiles",
              "IntegrationTestBuilder.FileContent",
              "IntegrationTestBuilder.ImageHelper",
              "IntegrationTestBuilder.Init",
              "IntegrationTestBuilder.RemoveFiles",
              "IntegrationTestBuilder.RemovePublishDir",
              "IntegrationTestBuilder.RenameDir",
              "IntegrationTestBuilder.RenameFile",
              "IntegrationTestBuilder.SiteHelper",
              "IntegrationTestImageHelper.AssertFormat",
              "IntegrationTestImageHelper.AssertFrameDurations",
              "IntegrationTestImageHelper.AssertIsAnimated",
              "IntegrationTestImageHelper.AssertLoopCount",
              "IntegrationTestPageHelper.MatrixFromFile",
              "IntegrationTestPageHelper.MatrixFromPageConfig",
              "IntegrationTestSiteHelper.PageHelper",
              "NewHugoSites",
              "NewIntegrationTestBuilder",
              "ShortcodeWithPage.InnerDeindent",
              "ShortcodeWithPage.Position",
              "ShortcodeWithPage.Ref",
              "ShortcodeWithPage.RelRef",
              "Site.AllPages",
              "Site.AllRegularPages",
              "Site.BuildDrafts",
              "Site.Data",
              "Site.Debug",
              "Site.Dimension",
              "Site.GetPage",
              "Site.LanguageCode",
              "Site.Languages",
              "Site.Menus",
              "Site.Pages",
              "Site.Param",
              "Site.RegisterMediaTypes",
              "Site.RegularPages",
              "Site.Sections",
              "Site.SitemapAbsURL",
              "Site.Sites",
              "Site.String",
              "Site.Taxonomies",
              "Test",
              "TestE",
              "TestRunning",
              "cachedContentScope.Content",
              "cachedContentScope.ContentWithoutSummary",
              "cachedContentScope.Fragments",
              "cachedContentScope.FuzzyWordCount",
              "cachedContentScope.Len",
              "cachedContentScope.Plain",
              "cachedContentScope.PlainWords",
              "cachedContentScope.ReadingTime",
              "cachedContentScope.RenderShortcodes",
              "cachedContentScope.RenderString",
              "cachedContentScope.Summary",
              "cachedContentScope.WordCount",
              "contentNodeShifter.DeleteFunc",
              "contentNodeShifter.ForEeachInAllDimensions",
              "contentNodeShifter.ForEeachInDimension",
              "contentNodeShifter.Insert",
              "contentNodeShifter.Shift",
              "contentNodesMap.ForEeachInAllDimensions",
              "contentTreeReverseIndex.Get",
              "helperContentNode.GetIdentity",
              "hookRendererTemplate.RenderBlockquote",
              "hookRendererTemplate.RenderCodeblock",
              "hookRendererTemplate.RenderHeading",
              "hookRendererTemplate.RenderLink",
              "hookRendererTemplate.RenderPassthrough",
              "hookRendererTemplate.RenderTable",
              "hookRendererTemplate.ResolvePosition",
              "hugoSitesSitesProvider.Data",
              "lockingBuffer.ReadFrom",
              "pageCommon.Scratch",
              "pageCommon.Store",
              "pageContentOutput.Content",
              "pageContentOutput.ContentWithoutSummary",
              "pageContentOutput.Fragments",
              "pageContentOutput.FuzzyWordCount",
              "pageContentOutput.Len",
              "pageContentOutput.Markup",
              "pageContentOutput.ParseAndRenderContent",
              "pageContentOutput.ParseContent",
              "pageContentOutput.Plain",
              "pageContentOutput.PlainWords",
              "pageContentOutput.ReadingTime",
              "pageContentOutput.Render",
              "pageContentOutput.RenderContent",
              "pageContentOutput.RenderShortcodes",
              "pageContentOutput.RenderString",
              "pageContentOutput.Summary",
              "pageContentOutput.TableOfContents",
              "pageContentOutput.Truncated",
              "pageContentOutput.WordCount",
              "pageMap.AddFi",
              "pageMap.CreateSiteTaxonomies",
              "pageMenus.HasMenuCurrent",
              "pageMenus.IsMenuCurrent",
              "pageMenus.Menus",
              "pageMetaSource.String",
              "pageMetaSource.initFrontMatter",
              "pagePaginator.Paginate",
              "pagePaginator.Paginator",
              "pagePosition.Next",
              "pagePosition.Prev",
              "pagePositionInSection.NextInSection",
              "pagePositionInSection.PrevInSection",
              "pageRef.Ref",
              "pageRef.RefFrom",
              "pageRef.RelRef",
              "pageRef.RelRefFrom",
              "pageSiteAdapter.GetPage",
              "pageState.AllTranslations",
              "pageState.ApplyFilterToHeadings",
              "pageState.Eq",
              "pageState.GetTerms",
              "pageState.Group",
              "pageState.IsTranslated",
              "pageState.MarshalJSON",
              "pageState.Pages",
              "pageState.Param",
              "pageState.RawContent",
              "pageState.RegularPages",
              "pageState.RegularPagesRecursive",
              "pageState.RelatedKeywords",
              "pageState.Resources",
              "pageState.Rotate",
              "pageState.Slice",
              "pageState.Translations",
              "pageTree.Ancestors",
              "pageTree.CurrentSection",
              "pageTree.FirstSection",
              "pageTree.InSection",
              "pageTree.Parent",
              "pageTree.Sections",
              "pageTree.SectionsEntries",
              "pageTree.SectionsPath",
              "pageTrees.DeletePageAndResourcesBelow",
              "pagesCollector.Collect",
              "resourceSource.GetIdentity",
              "resourceSource.String",
              "shortcode.String",
              "taxonomiesConfig.Values"
            ]
          }
        ]
      }
    }
  ],
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://github.com/gohugoio/hugo/security/advisories/GHSA-c54g-xjwj-8g82"
    },
    {
      "type": "FIX",
      "url": "https://github.com/gohugoio/hugo/commit/e41a06447daa3071a01f333fdcec0a5153c3c8d1"
    },
    {
      "type": "WEB",
      "url": "https://github.com/gohugoio/hugo/releases/tag/v0.162.0"
    }
  ],
  "database_specific": {
    "url": "https://pkg.go.dev/vuln/GO-2026-5313",
    "review_status": "REVIEWED"
  }
}