CVE-2026-35166 is a vulnerability in Hugo where improper escaping of links and image links in markdown to HTML rendering can be exploited by a remote attacker. By crafting malicious markdown content, an attacker could cause information disclosure or manipulate content when the markdown is processed. This vulnerability is related to CWE-79 (Improper Neutralization of Input During Web Page Generation, i.e., Cross-site Scripting). Red Hat's advisory highlights the risk of information disclosure and content manipulation due to this flaw in the Hugo package versions included in their hardened images. The vulnerability requires low privileges and user interaction, with a medium severity impact. Mitigation involves ensuring markdown content is from trusted sources or implementing custom render hooks to properly escape links and images.

The vulnerability can lead to information disclosure and content manipulation via cross-site scripting attacks. An attacker can exploit this by supplying malicious markdown content that, when rendered, executes scripts in the context of the user viewing the content. This could result in unauthorized code execution, theft of sensitive information such as cookies, or manipulation of site content. The impact is rated medium, with low complexity and requiring user interaction and low privileges.

Red Hat advises ensuring that all markdown content processed by Hugo originates from trusted sources to mitigate this vulnerability. Alternatively, users can implement custom render hooks for links and images within Hugo to ensure proper escaping, which prevents exploitation. No official patch or update is explicitly stated in the advisory; therefore, patch status is not yet confirmed — check the Red Hat advisory for current remediation guidance.