GO-2026-5313

See a problem?
Please try reporting it to the source first.

Source

https://pkg.go.dev/vuln/GO-2026-5313

Import Source

https://vuln.go.dev/ID/GO-2026-5313.json

JSON Data

https://api.osv.dev/v1/vulns/GO-2026-5313

Aliases

Published

2026-07-07T16:52:19Z

Modified

2026-07-07T20:30:13.658319903Z

Summary

Hugo: XSS via text/html content files in github.com/gohugoio/hugo

Details

Hugo: XSS via text/html content files in github.com/gohugoio/hugo

Database specific

{
    "url": "https://pkg.go.dev/vuln/GO-2026-5313",
    "review_status": "REVIEWED"
}

References

Affected packages

Go / github.com/gohugoio/hugo

Package

Name: github.com/gohugoio/hugo; View open source insights on deps.dev
Purl: pkg:golang/github.com/gohugoio/hugo

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

0.162.0

Ecosystem specific

{
    "imports": [
        {
            "path": "github.com/gohugoio/hugo/hugolib",
            "symbols": [
                "ContentFactory.ApplyArchetypeFi",
                "ContentFactory.ApplyArchetypeTemplate",
                "ContentFactory.CreateContentPlaceHolder",
                "ContentFactory.SectionFromFilename",
                "DefaultConfig",
                "ExampleConfig",
                "HugoSites.Build",
                "HugoSites.Close",
                "HugoSites.Data",
                "HugoSites.GC",
                "HugoSites.GetContentPage",
                "HugoSites.LogServerAddresses",
                "HugoSites.Pages",
                "HugoSites.PrintProcessingStats",
                "HugoSites.RegularPages",
                "IntegrationTestBuilder.AddFiles",
                "IntegrationTestBuilder.AssertFileContent",
                "IntegrationTestBuilder.AssertFileContentEquals",
                "IntegrationTestBuilder.AssertFileContentExact",
                "IntegrationTestBuilder.AssertFileCount",
                "IntegrationTestBuilder.AssertFileExists",
                "IntegrationTestBuilder.AssertFs",
                "IntegrationTestBuilder.AssertLogContains",
                "IntegrationTestBuilder.AssertLogMatches",
                "IntegrationTestBuilder.AssertNoRenderShortcodesArtifacts",
                "IntegrationTestBuilder.AssertPublishDir",
                "IntegrationTestBuilder.AssertRenderCountContent",
                "IntegrationTestBuilder.AssertRenderCountPage",
                "IntegrationTestBuilder.AssertRenderCountPageBetween",
                "IntegrationTestBuilder.Build",
                "IntegrationTestBuilder.BuildE",
                "IntegrationTestBuilder.BuildPartial",
                "IntegrationTestBuilder.BuildPartialE",
                "IntegrationTestBuilder.Close",
                "IntegrationTestBuilder.CreateDirs",
                "IntegrationTestBuilder.EditFileAppend",
                "IntegrationTestBuilder.EditFileReplaceAll",
                "IntegrationTestBuilder.EditFileReplaceFunc",
                "IntegrationTestBuilder.EditFiles",
                "IntegrationTestBuilder.FileContent",
                "IntegrationTestBuilder.ImageHelper",
                "IntegrationTestBuilder.Init",
                "IntegrationTestBuilder.RemoveFiles",
                "IntegrationTestBuilder.RemovePublishDir",
                "IntegrationTestBuilder.RenameDir",
                "IntegrationTestBuilder.RenameFile",
                "IntegrationTestBuilder.SiteHelper",
                "IntegrationTestImageHelper.AssertFormat",
                "IntegrationTestImageHelper.AssertFrameDurations",
                "IntegrationTestImageHelper.AssertIsAnimated",
                "IntegrationTestImageHelper.AssertLoopCount",
                "IntegrationTestPageHelper.MatrixFromFile",
                "IntegrationTestPageHelper.MatrixFromPageConfig",
                "IntegrationTestSiteHelper.PageHelper",
                "NewHugoSites",
                "NewIntegrationTestBuilder",
                "ShortcodeWithPage.InnerDeindent",
                "ShortcodeWithPage.Position",
                "ShortcodeWithPage.Ref",
                "ShortcodeWithPage.RelRef",
                "Site.AllPages",
                "Site.AllRegularPages",
                "Site.BuildDrafts",
                "Site.Data",
                "Site.Debug",
                "Site.Dimension",
                "Site.GetPage",
                "Site.LanguageCode",
                "Site.Languages",
                "Site.Menus",
                "Site.Pages",
                "Site.Param",
                "Site.RegisterMediaTypes",
                "Site.RegularPages",
                "Site.Sections",
                "Site.SitemapAbsURL",
                "Site.Sites",
                "Site.String",
                "Site.Taxonomies",
                "Test",
                "TestE",
                "TestRunning",
                "cachedContentScope.Content",
                "cachedContentScope.ContentWithoutSummary",
                "cachedContentScope.Fragments",
                "cachedContentScope.FuzzyWordCount",
                "cachedContentScope.Len",
                "cachedContentScope.Plain",
                "cachedContentScope.PlainWords",
                "cachedContentScope.ReadingTime",
                "cachedContentScope.RenderShortcodes",
                "cachedContentScope.RenderString",
                "cachedContentScope.Summary",
                "cachedContentScope.WordCount",
                "contentNodeShifter.DeleteFunc",
                "contentNodeShifter.ForEeachInAllDimensions",
                "contentNodeShifter.ForEeachInDimension",
                "contentNodeShifter.Insert",
                "contentNodeShifter.Shift",
                "contentNodesMap.ForEeachInAllDimensions",
                "contentTreeReverseIndex.Get",
                "helperContentNode.GetIdentity",
                "hookRendererTemplate.RenderBlockquote",
                "hookRendererTemplate.RenderCodeblock",
                "hookRendererTemplate.RenderHeading",
                "hookRendererTemplate.RenderLink",
                "hookRendererTemplate.RenderPassthrough",
                "hookRendererTemplate.RenderTable",
                "hookRendererTemplate.ResolvePosition",
                "hugoSitesSitesProvider.Data",
                "lockingBuffer.ReadFrom",
                "pageCommon.Scratch",
                "pageCommon.Store",
                "pageContentOutput.Content",
                "pageContentOutput.ContentWithoutSummary",
                "pageContentOutput.Fragments",
                "pageContentOutput.FuzzyWordCount",
                "pageContentOutput.Len",
                "pageContentOutput.Markup",
                "pageContentOutput.ParseAndRenderContent",
                "pageContentOutput.ParseContent",
                "pageContentOutput.Plain",
                "pageContentOutput.PlainWords",
                "pageContentOutput.ReadingTime",
                "pageContentOutput.Render",
                "pageContentOutput.RenderContent",
                "pageContentOutput.RenderShortcodes",
                "pageContentOutput.RenderString",
                "pageContentOutput.Summary",
                "pageContentOutput.TableOfContents",
                "pageContentOutput.Truncated",
                "pageContentOutput.WordCount",
                "pageMap.AddFi",
                "pageMap.CreateSiteTaxonomies",
                "pageMenus.HasMenuCurrent",
                "pageMenus.IsMenuCurrent",
                "pageMenus.Menus",
                "pageMetaSource.String",
                "pageMetaSource.initFrontMatter",
                "pagePaginator.Paginate",
                "pagePaginator.Paginator",
                "pagePosition.Next",
                "pagePosition.Prev",
                "pagePositionInSection.NextInSection",
                "pagePositionInSection.PrevInSection",
                "pageRef.Ref",
                "pageRef.RefFrom",
                "pageRef.RelRef",
                "pageRef.RelRefFrom",
                "pageSiteAdapter.GetPage",
                "pageState.AllTranslations",
                "pageState.ApplyFilterToHeadings",
                "pageState.Eq",
                "pageState.GetTerms",
                "pageState.Group",
                "pageState.IsTranslated",
                "pageState.MarshalJSON",
                "pageState.Pages",
                "pageState.Param",
                "pageState.RawContent",
                "pageState.RegularPages",
                "pageState.RegularPagesRecursive",
                "pageState.RelatedKeywords",
                "pageState.Resources",
                "pageState.Rotate",
                "pageState.Slice",
                "pageState.Translations",
                "pageTree.Ancestors",
                "pageTree.CurrentSection",
                "pageTree.FirstSection",
                "pageTree.InSection",
                "pageTree.Parent",
                "pageTree.Sections",
                "pageTree.SectionsEntries",
                "pageTree.SectionsPath",
                "pageTrees.DeletePageAndResourcesBelow",
                "pagesCollector.Collect",
                "resourceSource.GetIdentity",
                "resourceSource.String",
                "shortcode.String",
                "taxonomiesConfig.Values"
            ]
        }
    ]
}

Database specific

source

"https://vuln.go.dev/ID/GO-2026-5313.json"