Is CVE-2026-50133 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-50133 being exploited in the wild.

How severe is CVE-2026-50133?

Medium severity, with a CVSS score of 4, published 6 July 2026.

Which products and versions are affected?

github.com/gohugoio/hugo (Go) < 0.162.0, SEMVER:introduced=0,fixed=0.162.0; Hugo < 0.162.0.

Is there a fix for CVE-2026-50133?

Yes. github.com/gohugoio/hugo (Go): upgrade to 0.162.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-50133 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-50133?

Check whether you run github.com/gohugoio/hugo (Go) or Hugo at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-50133: Hugo stored XSS via verbatim HTML content processing

Q: Is there a fix for CVE-2026-50133?

Yes. github.com/gohugoio/hugo (Go): upgrade to 0.162.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-50133 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-50133?

Check whether you run github.com/gohugoio/hugo (Go) or Hugo at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-50133 · Severity: medium · CVSS 4 · Published 2026-07-06

Hugo, a popular tool for building websites, was found to have a security flaw that could allow malicious code to be embedded in a site. If a website pulls content from untrusted sources like external APIs or third-party editors, an attacker could inject scripts that run in the browsers of site visitors. This could lead to unauthorized actions or the theft of user information. The issue has been addressed by disabling the automatic processing of raw HTML files by default.

Technologies: github.com/gohugoio/hugo (Go), Hugo. Vendors: Go, Hugo.

Quick answers

Is CVE-2026-50133 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-50133 being exploited in the wild.
How severe is CVE-2026-50133?: Medium severity, with a CVSS score of 4, published 6 July 2026.
Which products and versions are affected?: github.com/gohugoio/hugo (Go) < 0.162.0, SEMVER:introduced=0,fixed=0.162.0; Hugo < 0.162.0.
Is there a fix for CVE-2026-50133?: Yes. github.com/gohugoio/hugo (Go): upgrade to 0.162.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-50133 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-50133?: Check whether you run github.com/gohugoio/hugo (Go) or Hugo at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/gohugoio/hugo (Go): upgrade to 0.162.0 or later
```
go get github.com/gohugoio/hugo@v0.162.0
```

Technical details

Hugo prior to version 0.162.0 is vulnerable to stored Cross-Site Scripting (XSS). The vulnerability exists because files mapped to the 'text/html' media type (such as .html files in the /content directory or those generated via content adapters) are emitted verbatim into the rendered static pages without sanitization. If a site's build pipeline ingests HTML from untrusted sources—such as a CMS, external API, or automated import—an attacker can inject malicious scripts. This has been mitigated in version 0.162.0 by introducing a 'security.allowContent' whitelist that denies 'text/html' by default. Users requiring this functionality must now explicitly opt-in via configuration.

Affected products

gohugoio Hugo < 0.162.0

Identifiers

CVE-2026-50133
GHSA-c54g-xjwj-8g82
GO-2026-5313

Timeline

2026-05-26: patched: Fix included in release v0.162.0
2026-05-28: advisory: GitHub Security Advisory GHSA-c54g-xjwj-8g82 published
2026-07-06: disclosed: CVE-2026-50133 published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.