Stored Cross-Site Scripting in Hugo Affecting Untrusted Markdown Content

CVE-2026-100691

What is CVE-2026-100691?

Hugo, a popular static site generator, is affected by a stored cross-site scripting (XSS) vulnerability that arises from improper handling of the 'lineAnchors' option in Markdown code blocks. When users include untrusted input as 'lineAnchors', the resulting HTML is not properly escaped, leading to the possibility of executing arbitrary JavaScript in the browsers of visitors viewing the generated site. This vulnerability has significant implications, particularly for sites that accept external contributions. The issue has been rectified in version 0.166.0, where the 'lineAnchors' value is now correctly HTML-escaped to prevent such attacks.

References