GitHub Advisoryadvisory · Go
GHSA-mcv8-8m8x-48pg Hugo: Certain markdown links are not properly escaped
MEDIUM
Official page ↗
- Aliases
- CVE-2026-35166
- Ecosystem
- Go
- Packages
- github.com/gohugoio/hugo
- Severity
- Moderate
- CVSS vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
- Weaknesses
- CWE-79
- Reviewed
- 2026-04-03
Affected packages
• Go github.com/gohugoio/hugo: >= 0.60.0, < 0.159.2 → fixed in 0.159.2
Description
Impact
Links and image links in the default markdown to HTML renderer are not properly escaped. Hugo users who trust their Markdown content or have custom render hooks for links and images are not affected.
Patches
Patched in v0.159.2
Workarounds
Create custom render hooks for links and images in a Hugo theme/project.
Related
Alias · CVE (1)
- CVE-2026-35166 Hugo is a static site generator. vulnerability
Weakness · CWE (1)
- CWE-79 Improper Neutralization of Input During Web Page Generation weakness