Hugo: XSS via text/html content files

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-50133 · Microsoft / collected KEV context

EUVD-2026-41909

GHSA-c54g-xjwj-8g82

GO-2026-5313

cve-program · CVE-2026-50133

• https://github.com/gohugoio/hugo/security/advisories/GHSA-c54g-xjwj-8g82
• https://github.com/gohugoio/hugo/commit/e41a06447daa3071a01f333fdcec0a5153c3c8d1
• https://github.com/gohugoio/hugo/releases/tag/v0.162.0

euvd · EUVD-2026-41909

• https://github.com/gohugoio/hugo/security/advisories/GHSA-c54g-xjwj-8g82
• https://github.com/gohugoio/hugo/commit/e41a06447daa3071a01f333fdcec0a5153c3c8d1
• https://github.com/gohugoio/hugo/releases/tag/v0.162.0

nvd · CVE-2026-50133

• https://github.com/gohugoio/hugo/commit/e41a06447daa3071a01f333fdcec0a5153c3c8d1
• https://github.com/gohugoio/hugo/releases/tag/v0.162.0
• https://github.com/gohugoio/hugo/security/advisories/GHSA-c54g-xjwj-8g82

osv · GHSA-c54g-xjwj-8g82

• https://github.com/gohugoio/hugo/security/advisories/GHSA-c54g-xjwj-8g82
• https://github.com/gohugoio/hugo/commit/e41a06447daa3071a01f333fdcec0a5153c3c8d1
• https://github.com/gohugoio/hugo
• https://github.com/gohugoio/hugo/releases/tag/v0.162.0

osv · GO-2026-5313

• https://github.com/gohugoio/hugo/security/advisories/GHSA-c54g-xjwj-8g82
• https://github.com/gohugoio/hugo/commit/e41a06447daa3071a01f333fdcec0a5153c3c8d1
• https://github.com/gohugoio/hugo/releases/tag/v0.162.0

No related operational record is retained in the current change model.