Threats tagged 'ghsa-8v94-8989-vc79'

A stored cross-site scripting (XSS) vulnerability exists in Hugo versions 0.75.0 through 0.165.x. The issue arises because the syntax highlighter does not properly escape the lineAnchors option before passing it to Chroma, which inserts the value directly into HTML attributes. This allows an attacker to inject arbitrary JavaScript into the generated pages if untrusted Markdown content is published. The vulnerability is fixed in version 0.166.0 by HTML-escaping the lineAnchors value before use.