CVE-2026-109597: Hugo v0.60.0 before v0.167.0 Stored XSS via Table of Contents Heading IDs

Q: Who can exploit this vulnerability?

An attacker needs the ability to author or modify Markdown content processed by Hugo. Exploitation also requires a user to interact with the injected content, such as triggering an event handler in the rendered page.

Q: Which Hugo output is affected?

The issue affects rendered output using .TableOfContents or .Fragments.ToHTML when Markdown contains crafted explicit heading IDs. The crafted ID can escape an unescaped href attribute and inject HTML elements with event handlers.

Q: Which versions should be treated as vulnerable?

Hugo versions from v0.60.0 up to, but not including, v0.167.0 are affected. Upgrading to v0.167.0 or later removes the affected version range.

Published Oct 12, 2026

Updated

Hugo from v0.60.0 before v0.167.0 contains a stored cross-site scripting vulnerability that allows Markdown content authors to inject HTML by supplying crafted explicit heading IDs. Attackers can break out of the unescaped href attribute in .TableOfContents or .Fragments.ToHTML output to inject elements with event handlers into rendered pages.

Affected Software

1 affected component

Hugo Hugo>=0.60.0<0.167.0

Event History

Oct 12, 2026

CVE Published

via MITRE·10:21 PM

Data Sourced

via MITRE·10:21 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·11:17 PM

DescriptionSeverityWeakness

Oct 13, 2026

Event

via NVD·12:17 AM

Frequently Asked Questions

Who can exploit this vulnerability?

An attacker needs the ability to author or modify Markdown content processed by Hugo. Exploitation also requires a user to interact with the injected content, such as triggering an event handler in the rendered page.

Which Hugo output is affected?

The issue affects rendered output using .TableOfContents or .Fragments.ToHTML when Markdown contains crafted explicit heading IDs. The crafted ID can escape an unescaped href attribute and inject HTML elements with event handlers.

Which versions should be treated as vulnerable?

Hugo versions from v0.60.0 up to, but not including, v0.167.0 are affected. Upgrading to v0.167.0 or later removes the affected version range.

CVE-2026-109597: Hugo v0.60.0 before v0.167.0 Stored XSS via Table of Contents Heading IDs

Affected Software

Event History

Frequently Asked Questions

Who can exploit this vulnerability?

Which Hugo output is affected?

Which versions should be treated as vulnerable?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this vulnerability?

Which Hugo output is affected?

Which versions should be treated as vulnerable?