PT-2026-111016 · Hugo · Hugo
CVSS v3.1
5.4
Medium
| Vector | AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
Hugo versions 0.60.0 through 0.166.0
Description
A stored cross-site scripting issue allows Markdown content authors to inject HTML by providing crafted explicit heading IDs. This occurs when attackers break out of the unescaped href attribute within the
.TableOfContents or .Fragments.ToHTML output, enabling the injection of elements with event handlers into rendered pages.Recommendations
Update Hugo to version 0.167.0 or later.
Exploit
Fix
XSS
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Hugo