CVE-2026-100691: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in gohugoio hugo
Hugo versions 0.75.0 through 0.165.x contain a stored cross-site scripting vulnerability: the syntax highlighter does not escape the `lineAnchors` option before passing it to Chroma, which writes the value verbatim into the `id` and `href` attributes of the generated line-number markup. A crafted `lineAnchors` value supplied as a Markdown code fence attribute (or passed to the `highlight` template function) results in unescaped HTML in the rendered page, allowing arbitrary JavaScript to execute in the browsers of visitors to the generated site. This affects sites that build and publish Markdown from untrusted contributors; Hugo's security model otherwise considers content trusted input. Fixed in 0.166.0, where the `lineAnchors` value is HTML-escaped before being passed to Chroma.
AI Analysis
Technical Summary
Hugo versions 0.75.0 through 0.165.x contain a stored XSS vulnerability due to improper neutralization of input in the lineAnchors option used by the syntax highlighter. The lineAnchors value is passed verbatim to Chroma, which embeds it into the id and href attributes of line-number markup in generated pages. If untrusted Markdown content supplies a crafted lineAnchors value (via code fence attributes or the highlight template function), it results in unescaped HTML and JavaScript execution in site visitors' browsers. This affects sites that build and publish Markdown from untrusted contributors. The vulnerability is addressed in version 0.166.0 by escaping the lineAnchors value before passing it to Chroma.
Potential Impact
Exploitation of this vulnerability allows an attacker to execute arbitrary JavaScript in the browsers of visitors to affected sites. This can lead to session hijacking, defacement, or other client-side attacks. The impact is limited to sites that incorporate untrusted Markdown content and use the vulnerable Hugo versions. Trusted content sites are not affected under Hugo's security model.
Mitigation Recommendations
A fix is available in Hugo version 0.166.0, which properly escapes the lineAnchors value before use. Users should upgrade to version 0.166.0 or later to remediate this vulnerability. Sites that do not build from untrusted Markdown content are not at risk under normal usage. No additional mitigation is required once upgraded.
CVE-2026-100691: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in gohugoio hugo
Description
Hugo versions 0.75.0 through 0.165.x contain a stored cross-site scripting vulnerability: the syntax highlighter does not escape the `lineAnchors` option before passing it to Chroma, which writes the value verbatim into the `id` and `href` attributes of the generated line-number markup. A crafted `lineAnchors` value supplied as a Markdown code fence attribute (or passed to the `highlight` template function) results in unescaped HTML in the rendered page, allowing arbitrary JavaScript to execute in the browsers of visitors to the generated site. This affects sites that build and publish Markdown from untrusted contributors; Hugo's security model otherwise considers content trusted input. Fixed in 0.166.0, where the `lineAnchors` value is HTML-escaped before being passed to Chroma.
CVSS v4.0
Score 5.1medium
Affected software
gohugoio
hugo
pkg:golang/github.com/gohugoio/hugoRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Hugo versions 0.75.0 through 0.165.x contain a stored XSS vulnerability due to improper neutralization of input in the lineAnchors option used by the syntax highlighter. The lineAnchors value is passed verbatim to Chroma, which embeds it into the id and href attributes of line-number markup in generated pages. If untrusted Markdown content supplies a crafted lineAnchors value (via code fence attributes or the highlight template function), it results in unescaped HTML and JavaScript execution in site visitors' browsers. This affects sites that build and publish Markdown from untrusted contributors. The vulnerability is addressed in version 0.166.0 by escaping the lineAnchors value before passing it to Chroma.
Potential Impact
Exploitation of this vulnerability allows an attacker to execute arbitrary JavaScript in the browsers of visitors to affected sites. This can lead to session hijacking, defacement, or other client-side attacks. The impact is limited to sites that incorporate untrusted Markdown content and use the vulnerable Hugo versions. Trusted content sites are not affected under Hugo's security model.
Mitigation Recommendations
A fix is available in Hugo version 0.166.0, which properly escapes the lineAnchors value before use. Users should upgrade to version 0.166.0 or later to remediate this vulnerability. Sites that do not build from untrusted Markdown content are not at risk under normal usage. No additional mitigation is required once upgraded.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-09-26T02:37:41.037Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6ab7c9adf7a7c5410652fd5a
Added to database: 09/26/2026, 13:33:33 UTC
Last enriched: 09/26/2026, 13:48:27 UTC
Last updated: 09/27/2026, 01:57:11 UTC
Views: 12
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.