CVE-2026-100691

Name of the Vulnerable Software and Affected Versions Hugo versions 0.75.0 through 0.165.x

Description A stored cross-site scripting issue exists because the syntax highlighter fails to escape the lineAnchors option before passing it to Chroma. This causes the value to be written verbatim into the id and href attributes of the generated line-number markup. If a crafted lineAnchors value is provided via a Markdown code fence attribute or the highlight template function, unescaped HTML is rendered on the page, enabling arbitrary JavaScript execution in the browsers of visitors. This specifically impacts sites that build and publish Markdown content from untrusted contributors.

Recommendations Update Hugo to version 0.166.0.