PT-2026-30283
CVE-2026-35166
·
Published
2026-04-03
·
Updated
2026-09-22
Description by
CVSS 3.1
5.4
MediumMetricsAV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Name of the Vulnerable Software and Affected Versions
Hugo versions 0.60.0 through 0.159.1
Description
Hugo, a static site generator, has an issue where links and image links in the default markdown to HTML renderer are not properly escaped. Users who trust their Markdown content or have custom render hooks for links and images are not affected.
Recommendations
Update to version 0.159.2 or later.
Create custom render hooks for links and images in a Hugo theme/project.
Exploitability
Exploit
Fix
Impacts
Researchers
Vendors
Affected products
Found an issue in the description? Have something to add? Feel free to write us 👾