CVE-2026-100691: Hugo before 0.166.0 Stored XSS via lineAnchors code block option
Hugo versions 0.75.0 through 0.165.x contain a stored cross-site scripting vulnerability: the syntax highlighter does not escape the lineAnchors option before passing it to Chroma, which writes the value verbatim into the id and href attributes of the generated line-number markup. A crafted lineAnchors value supplied as a Markdown code fence attribute (or passed to the highlight template function) results in unescaped HTML in the rendered page, allowing arbitrary JavaScript to execute in the browsers of visitors to the generated site. This affects sites that build and publish Markdown from untrusted contributors; Hugo's security model otherwise considers content trusted input. Fixed in 0.166.0, where the lineAnchors value is HTML-escaped before being passed to Chroma.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Hugoto a version that resolves this vulnerability.Fixed in 0.166.0
Event History
Frequently Asked Questions
Which sites are realistically exposed?
Sites using Hugo 0.75.0 through 0.165.x are exposed when they build and publish Markdown supplied by untrusted contributors. Hugo otherwise treats content as trusted input, so sites where only trusted users can modify content have a substantially narrower exposure scenario.
What does an attacker need to exploit this issue?
An attacker needs the ability to provide Markdown that is rendered and published by the site, using a crafted lineAnchors value in a code fence attribute. The same vulnerable value can also be supplied through the highlight template function.
What is the impact after malicious content is published?
The crafted value is written unescaped into generated id and href attributes in line-number markup. This permits arbitrary JavaScript execution in the browsers of visitors to the affected generated page.
What can be done if upgrading is not immediately possible?
Do not accept or publish untrusted Markdown containing code fence attributes that can set lineAnchors, and prevent untrusted input from reaching uses of the highlight template function. Review contributor-supplied content before publication, particularly code blocks with highlighting options.
How can I determine whether content may already be affected?
Review published or pending Markdown from untrusted contributors for code fence attributes that set lineAnchors, and review template usage of the highlight function where its options may be influenced by untrusted input. Generated pages with line-number markup should also be checked for unexpected or unescaped content in id and href attributes.