CVE-2026-50133

Hugo is a static site generator. Prior to 0.162.0, Hugo accepts content files in several markup formats. Files mapped to the text/html media type (typically .html files under /content, or pages produced by a content adapter that sets content.mediaType = "text/html") had their body emitted verbatim into the rendered page. A site that ingests HTML content from an untrusted source could therefore be served stored cross-site scripting. This vulnerability is fixed in 0.162.0.

• CWE-79

• https://github.com/gohugoio/hugo/commit/e41a06447daa3071a01f333fdcec0a5153c3c8d1Patch
• https://github.com/gohugoio/hugo/releases/tag/v0.162.0Release Notes
• https://github.com/gohugoio/hugo/security/advisories/GHSA-c54g-xjwj-8g82Vendor Advisory

Published

Jul 6, 2026

Last Modified

Jul 8, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-50128Mastodon is a free, open-source social network server based …5.3
• CVE-2026-50129Mastodon is a free, open-source social network server based …7.5
• CVE-2026-5013A vulnerability has been found in elecV2 elecV2P up to 3.8.3…5.5
• CVE-2026-50130Pi-hole is a DNS sinkhole that protects devices from unwante…8.8
• CVE-2026-50131Fedify is a TypeScript library for building federated server…8.6
• CVE-2026-50132Budibase is an open-source low-code platform. Prior to 3.39.…7.3
• CVE-2026-50134Hugo is a static site generator. From 0.91.0 until 0.162.0, …5.8
• CVE-2026-50135Hugo is a static site generator. From 0.123.0 to 0.161.1, a …5.5
• CVE-2026-50136Budibase is an open-source low-code platform. Prior to 3.39.…5.3
• CVE-2026-50137Budibase is an open-source low-code platform. Prior to 3.39.…9.4
• CVE-2026-50138goshs is a SimpleHTTPServer written in Go. Prior to version …8.1
• CVE-2026-50139goshs is a SimpleHTTPServer written in Go. Prior to version …5.9