CVE-2026-109597
Hugo v0.60.0 before v0.167.0 Stored XSS via Table of Contents Heading IDs
- State
- Published
- Severity
- 5.1 Medium
- Published
- Oct 12, 2026
- Updated
- Oct 13, 2026
- Reserved
- Oct 12, 2026
Description
Hugo from v0.60.0 before v0.167.0 contains a stored cross-site scripting vulnerability that allows Markdown content authors to inject HTML by supplying crafted explicit heading IDs. Attackers can break out of the unescaped href attribute in .TableOfContents or .Fragments.ToHTML output to inject elements with event handlers into rendered pages.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 5.1 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N | VulnCheck |
| 3.1 | 5.4 Medium | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N | VulnCheck |
Weaknesses
- CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected Products
| Product | Versions |
|---|---|
hugogohugoio |
|
References
- GitHub Security Advisory (GHSA-wcpj-vcvm-j4pg)vendor-advisory
- VulnCheck Advisory: Hugo v0.60.0 before v0.167.0 Stored XSS via Table of Contents Heading IDsthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.