| id: GO-2026-5313 | |
| modules: | |
| - module: github.com/gohugoio/hugo | |
| versions: | |
| - fixed: 0.162.0 | |
| vulnerable_at: 0.161.1 | |
| packages: | |
| - package: github.com/gohugoio/hugo/hugolib | |
| symbols: | |
| - pageMetaSource.initFrontMatter | |
| derived_symbols: | |
| - ContentFactory.ApplyArchetypeFi | |
| - ContentFactory.ApplyArchetypeTemplate | |
| - ContentFactory.CreateContentPlaceHolder | |
| - ContentFactory.SectionFromFilename | |
| - DefaultConfig | |
| - ExampleConfig | |
| - HugoSites.Build | |
| - HugoSites.Close | |
| - HugoSites.Data | |
| - HugoSites.GC | |
| - HugoSites.GetContentPage | |
| - HugoSites.LogServerAddresses | |
| - HugoSites.Pages | |
| - HugoSites.PrintProcessingStats | |
| - HugoSites.RegularPages | |
| - IntegrationTestBuilder.AddFiles | |
| - IntegrationTestBuilder.AssertFileContent | |
| - IntegrationTestBuilder.AssertFileContentEquals | |
| - IntegrationTestBuilder.AssertFileContentExact | |
| - IntegrationTestBuilder.AssertFileCount | |
| - IntegrationTestBuilder.AssertFileExists | |
| - IntegrationTestBuilder.AssertFs | |
| - IntegrationTestBuilder.AssertLogContains | |
| - IntegrationTestBuilder.AssertLogMatches | |
| - IntegrationTestBuilder.AssertNoRenderShortcodesArtifacts | |
| - IntegrationTestBuilder.AssertPublishDir | |
| - IntegrationTestBuilder.AssertRenderCountContent | |
| - IntegrationTestBuilder.AssertRenderCountPage | |
| - IntegrationTestBuilder.AssertRenderCountPageBetween | |
| - IntegrationTestBuilder.Build | |
| - IntegrationTestBuilder.BuildE | |
| - IntegrationTestBuilder.BuildPartial | |
| - IntegrationTestBuilder.BuildPartialE | |
| - IntegrationTestBuilder.Close | |
| - IntegrationTestBuilder.CreateDirs | |
| - IntegrationTestBuilder.EditFileAppend | |
| - IntegrationTestBuilder.EditFileReplaceAll | |
| - IntegrationTestBuilder.EditFileReplaceFunc | |
| - IntegrationTestBuilder.EditFiles | |
| - IntegrationTestBuilder.FileContent | |
| - IntegrationTestBuilder.ImageHelper | |
| - IntegrationTestBuilder.Init | |
| - IntegrationTestBuilder.RemoveFiles | |
| - IntegrationTestBuilder.RemovePublishDir | |
| - IntegrationTestBuilder.RenameDir | |
| - IntegrationTestBuilder.RenameFile | |
| - IntegrationTestBuilder.SiteHelper | |
| - IntegrationTestImageHelper.AssertFormat | |
| - IntegrationTestImageHelper.AssertFrameDurations | |
| - IntegrationTestImageHelper.AssertIsAnimated | |
| - IntegrationTestImageHelper.AssertLoopCount | |
| - IntegrationTestPageHelper.MatrixFromFile | |
| - IntegrationTestPageHelper.MatrixFromPageConfig | |
| - IntegrationTestSiteHelper.PageHelper | |
| - NewHugoSites | |
| - NewIntegrationTestBuilder | |
| - ShortcodeWithPage.InnerDeindent | |
| - ShortcodeWithPage.Position | |
| - ShortcodeWithPage.Ref | |
| - ShortcodeWithPage.RelRef | |
| - Site.AllPages | |
| - Site.AllRegularPages | |
| - Site.BuildDrafts | |
| - Site.Data | |
| - Site.Debug | |
| - Site.Dimension | |
| - Site.GetPage | |
| - Site.LanguageCode | |
| - Site.Languages | |
| - Site.Menus | |
| - Site.Pages | |
| - Site.Param | |
| - Site.RegisterMediaTypes | |
| - Site.RegularPages | |
| - Site.Sections | |
| - Site.SitemapAbsURL | |
| - Site.Sites | |
| - Site.String | |
| - Site.Taxonomies | |
| - Test | |
| - TestE | |
| - TestRunning | |
| - cachedContentScope.Content | |
| - cachedContentScope.ContentWithoutSummary | |
| - cachedContentScope.Fragments | |
| - cachedContentScope.FuzzyWordCount | |
| - cachedContentScope.Len | |
| - cachedContentScope.Plain | |
| - cachedContentScope.PlainWords | |
| - cachedContentScope.ReadingTime | |
| - cachedContentScope.RenderShortcodes | |
| - cachedContentScope.RenderString | |
| - cachedContentScope.Summary | |
| - cachedContentScope.WordCount | |
| - contentNodeShifter.DeleteFunc | |
| - contentNodeShifter.ForEeachInAllDimensions | |
| - contentNodeShifter.ForEeachInDimension | |
| - contentNodeShifter.Insert | |
| - contentNodeShifter.Shift | |
| - contentNodesMap.ForEeachInAllDimensions | |
| - contentTreeReverseIndex.Get | |
| - helperContentNode.GetIdentity | |
| - hookRendererTemplate.RenderBlockquote | |
| - hookRendererTemplate.RenderCodeblock | |
| - hookRendererTemplate.RenderHeading | |
| - hookRendererTemplate.RenderLink | |
| - hookRendererTemplate.RenderPassthrough | |
| - hookRendererTemplate.RenderTable | |
| - hookRendererTemplate.ResolvePosition | |
| - hugoSitesSitesProvider.Data | |
| - lockingBuffer.ReadFrom | |
| - pageCommon.Scratch | |
| - pageCommon.Store | |
| - pageContentOutput.Content | |
| - pageContentOutput.ContentWithoutSummary | |
| - pageContentOutput.Fragments | |
| - pageContentOutput.FuzzyWordCount | |
| - pageContentOutput.Len | |
| - pageContentOutput.Markup | |
| - pageContentOutput.ParseAndRenderContent | |
| - pageContentOutput.ParseContent | |
| - pageContentOutput.Plain | |
| - pageContentOutput.PlainWords | |
| - pageContentOutput.ReadingTime | |
| - pageContentOutput.Render | |
| - pageContentOutput.RenderContent | |
| - pageContentOutput.RenderShortcodes | |
| - pageContentOutput.RenderString | |
| - pageContentOutput.Summary | |
| - pageContentOutput.TableOfContents | |
| - pageContentOutput.Truncated | |
| - pageContentOutput.WordCount | |
| - pageMap.AddFi | |
| - pageMap.CreateSiteTaxonomies | |
| - pageMenus.HasMenuCurrent | |
| - pageMenus.IsMenuCurrent | |
| - pageMenus.Menus | |
| - pageMetaSource.String | |
| - pagePaginator.Paginate | |
| - pagePaginator.Paginator | |
| - pagePosition.Next | |
| - pagePosition.Prev | |
| - pagePositionInSection.NextInSection | |
| - pagePositionInSection.PrevInSection | |
| - pageRef.Ref | |
| - pageRef.RefFrom | |
| - pageRef.RelRef | |
| - pageRef.RelRefFrom | |
| - pageSiteAdapter.GetPage | |
| - pageState.AllTranslations | |
| - pageState.ApplyFilterToHeadings | |
| - pageState.Eq | |
| - pageState.GetTerms | |
| - pageState.Group | |
| - pageState.IsTranslated | |
| - pageState.MarshalJSON | |
| - pageState.Pages | |
| - pageState.Param | |
| - pageState.RawContent | |
| - pageState.RegularPages | |
| - pageState.RegularPagesRecursive | |
| - pageState.RelatedKeywords | |
| - pageState.Resources | |
| - pageState.Rotate | |
| - pageState.Slice | |
| - pageState.Translations | |
| - pageTree.Ancestors | |
| - pageTree.CurrentSection | |
| - pageTree.FirstSection | |
| - pageTree.InSection | |
| - pageTree.Parent | |
| - pageTree.Sections | |
| - pageTree.SectionsEntries | |
| - pageTree.SectionsPath | |
| - pageTrees.DeletePageAndResourcesBelow | |
| - pagesCollector.Collect | |
| - resourceSource.GetIdentity | |
| - resourceSource.String | |
| - shortcode.String | |
| - taxonomiesConfig.Values | |
| summary: 'Hugo: XSS via text/html content files in github.com/gohugoio/hugo' | |
| cves: | |
| - CVE-2026-50133 | |
| ghsas: | |
| - GHSA-c54g-xjwj-8g82 | |
| references: | |
| - advisory: https://github.com/gohugoio/hugo/security/advisories/GHSA-c54g-xjwj-8g82 | |
| - fix: https://github.com/gohugoio/hugo/commit/e41a06447daa3071a01f333fdcec0a5153c3c8d1 | |
| - web: https://github.com/gohugoio/hugo/releases/tag/v0.162.0 | |
| source: | |
| id: GHSA-c54g-xjwj-8g82 | |
| created: 2026-07-07T00:03:50.202508053-04:00 | |
| review_status: REVIEWED |