{"id":"EUVD-2026-41909","enisaUuid":"a741fa45-aa65-3724-8afa-369ac8baa4bf","description":"Hugo is a static site generator. Prior to 0.162.0, Hugo accepts content files in several markup formats. Files mapped to the text/html media type (typically .html files under /content, or pages produced by a content adapter that sets content.mediaType \u003d \"text/html\") had their body emitted verbatim into the rendered page. A site that ingests HTML content from an untrusted source could therefore be served stored cross-site scripting. This vulnerability is fixed in 0.162.0.","datePublished":"Jul 6, 2026, 7:31:18 PM","dateUpdated":"Jul 7, 2026, 2:44:31 PM","baseScore":5.1,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","references":"https://github.com/gohugoio/hugo/security/advisories/GHSA-c54g-xjwj-8g82\nhttps://github.com/gohugoio/hugo/commit/e41a06447daa3071a01f333fdcec0a5153c3c8d1\nhttps://github.com/gohugoio/hugo/releases/tag/v0.162.0\n","aliases":"CVE-2026-50133\nGHSA-c54g-xjwj-8g82\n","assigner":"GitHub_M","epss":0.33,"enisaIdProduct":[{"id":"3bdbf5d5-70c4-3bf0-844f-9bdee923cb2b","product":{"name":"hugo","vendor":{"name":"gohugoio"}},"product_version":"\u003c 0.162.0"}],"enisaIdVendor":[{"id":"ce8c8596-0874-36d0-9456-6d8e71613a35","vendor":{"name":"gohugoio"}}],"enisaIdVulnerability":[{"id":"40122b00-45d4-33c2-9b5a-51f7d3257928","vulnerability":{"id":"CVE-2026-50133","description":"Hugo is a static site generator. Prior to 0.162.0, Hugo accepts content files in several markup formats. Files mapped to the text/html media type (typically .html files under /content, or pages produced by a content adapter that sets content.mediaType \u003d \"text/html\") had their body emitted verbatim into the rendered page. A site that ingests HTML content from an untrusted source could therefore be served stored cross-site scripting. This vulnerability is fixed in 0.162.0.","datePublished":"Jul 6, 2026, 7:31:18 PM","dateUpdated":"Jul 7, 2026, 2:44:31 PM","status":"PUBLISHED","baseScore":5.1,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","references":"https://github.com/gohugoio/hugo/security/advisories/GHSA-c54g-xjwj-8g82\nhttps://github.com/gohugoio/hugo/commit/e41a06447daa3071a01f333fdcec0a5153c3c8d1\nhttps://github.com/gohugoio/hugo/releases/tag/v0.162.0\n","enisa_id":"EUVD-2026-41909\n","assigner":"GitHub_M","epss":0.33,"dataProcessed":"Oct 30, 2026, 7:15:41 AM","vulnerabilityProduct":[{"id":"e1fc46fa-6fb9-3d23-91fe-be6c31bb02ac","product":{"name":"hugo","vendor":{"name":"gohugoio"}},"product_version":"\u003c 0.162.0"}],"vulnerabilityVendor":[{"id":"30bbeba2-919d-3337-b961-d4e1fcd8311f","vendor":{"name":"gohugoio"}}]}},{"id":"dda282e7-6558-3ca4-afd1-d560013638e5","vulnerability":{"id":"GHSA-c54g-xjwj-8g82","description":"Hugo: XSS via text/html content files","datePublished":"Jun 16, 2026, 7:22:14 PM","dateUpdated":"Jun 16, 2026, 7:22:14 PM","baseScore":0.0,"references":"https://github.com/gohugoio/hugo/security/advisories/GHSA-c54g-xjwj-8g82\nhttps://github.com/gohugoio/hugo/commit/e41a06447daa3071a01f333fdcec0a5153c3c8d1\nhttps://github.com/gohugoio/hugo\nhttps://github.com/gohugoio/hugo/releases/tag/v0.162.0\n","enisa_id":"EUVD-2026-41909\n","aliases":"GHSA-c54g-xjwj-8g82\nCVE-2026-50133\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 1:57:08 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[{"id":"99d92068-5c0e-3b0c-8735-ef6a597a0aea","advisory":{"id":"RHSA-2026:36862","description":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","summary":"An update for Red Hat Hardened Images RPMs is now available.","datePublished":"Jul 8, 2026, 8:16:29 PM","dateUpdated":"Sep 8, 2026, 12:06:46 AM","baseScore":0.0,"references":"https://access.redhat.com/errata/RHSA-2026:36862\nhttps://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_36862.json\n","aliases":"CVE-2026-50133\nCVE-2026-58402\nCVE-2026-58403\nCVE-2026-58404\n","source":{"id":9,"name":"csaf_redhat"},"advisoryProduct":[{"id":"49c3db57-a74d-31eb-9130-2db9e2e58362","product":{"name":"hugo-main@src","vendor":{"name":"Red Hat"}}},{"id":"9ec5bace-2d36-3dd2-9585-a6b6f9d6e72e","product":{"name":"Red Hat Hardened Images","vendor":{"name":"Red Hat"}}},{"id":"a13e8035-a773-3f92-a83d-87720fd9999c","product":{"name":"hugo-main@x86_64","vendor":{"name":"Red Hat"}}},{"id":"efdf1028-b694-3d4a-90c4-28adde3fb315","product":{"name":"hugo-main@aarch64","vendor":{"name":"Red Hat"}}}]}}]}