{"id":"GO-2026-5681","revision":"2c48960c8c344281ae636cc49abc21e7","records":[{"revision":"2c48960c8c344281ae636cc49abc21e7","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GO-2026-5681","aliases":["CVE-2026-50134","GHSA-vxgm-5rmg-5w8g"],"title":"Hugo: security.http.urls allow-list bypass via HTTP redirects in github.com/gohugoio/hugo","description":"Hugo: security.http.urls allow-list bypass via HTTP redirects in github.com/gohugoio/hugo","state":0,"publishedAt":"2026-07-07T16:52:19+00:00","modifiedAt":"2026-07-07T20:30:17.5374429+00:00","affected":[{"ecosystem":"Go","name":"github.com/gohugoio/hugo","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0.91.0"},{"kind":"fixed","version":"0.162.0"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://github.com/gohugoio/hugo/security/advisories/GHSA-vxgm-5rmg-5w8g","https://github.com/gohugoio/hugo/commit/86fbb0f7a8bbb93e2e916390de9e5a4f24bf9f50","https://github.com/gohugoio/hugo/releases/tag/v0.162.0"],"sourceUrl":"https://osv.dev/vulnerability/GO-2026-5681","license":"OSV · upstream source license applies","key":"osv:GO-2026-5681","identifiers":["GO-2026-5681","CVE-2026-50134","GHSA-vxgm-5rmg-5w8g"]},"retained":false,"historicalAffected":[]}],"coverage":[]}