CVE-2026-109597

5.4Medium

Published 12 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash

5.4Medium

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: Required
Impact: Limited impact
Weakness: CWE-79

Impact

Untrusted content authors can execute stored cross-site scripting in visitors' browsers by injecting malicious heading IDs into rendered pages. An attacker needs permission to publish or edit Markdown content on the site.

Root cause

Hugo fails to escape explicit heading IDs inside href attributes generated by .TableOfContents and .Fragments.ToHTML templates.

Affected systems

Hugo v0.60.0 before v0.167.0

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Fix & remediation

Upgrade Hugo to version 0.167.0 or later. If upgrading immediately is not possible, audit Markdown content for explicit heading IDs or remove .TableOfContents and .Fragments.ToHTML calls from page templates.

shell

$ hugo version

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

Hugo from v0.60.0 before v0.167.0 contains a stored cross-site scripting vulnerability that allows Markdown content authors to inject HTML by supplying crafted explicit heading IDs. Attackers can break out of the unescaped href attribute in .TableOfContents or .Fragments.ToHTML output to inject elements with event handlers into rendered pages.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-109597