CVE-2026-109597

Received Received - Intake

Stored XSS in Hugo Static Site Generator

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: VulnCheck

Description

Hugo from v0.60.0 before v0.167.0 contains a stored cross-site scripting vulnerability that allows Markdown content authors to inject HTML by supplying crafted explicit heading IDs. Attackers can break out of the unescaped href attribute in .TableOfContents or .Fragments.ToHTML output to inject elements with event handlers into rendered pages.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-12

Last Modified

2026-10-12

Generated

2026-10-13

AI Q&A

2026-10-13

EPSS Evaluated

N/A

NVD

CVE-2026-109597

Affected Vendors & Products

Vendor	Product	Version / Range
gohugoio	hugo	0.60.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

Hugo versions from v0.60.0 to before v0.167.0 have a stored cross-site scripting (XSS) vulnerability. Markdown authors can inject HTML by crafting explicit heading IDs. Attackers exploit this by breaking out of unescaped href attributes in .TableOfContents or .Fragments.ToHTML output to inject event handlers into pages.

Detection Guidance

To detect this vulnerability, inspect Hugo-generated HTML output for crafted heading IDs in Markdown content. Check .TableOfContents or .Fragments.ToHTML outputs for unescaped href attributes that may contain event handlers like onerror or onclick. Review server logs for unusual HTML injection patterns in rendered pages.

Impact Analysis

If you use a vulnerable Hugo version, attackers could inject malicious scripts into your site. This could lead to unauthorized actions on behalf of users, data theft, or defacement of your web pages. Users visiting your site might have their sessions compromised.

Compliance Impact

This XSS vulnerability could expose user data, violating GDPR's data protection requirements. For HIPAA, it may compromise protected health information integrity. Organizations must address this to maintain compliance and avoid legal penalties.

Mitigation Strategies

Upgrade Hugo to v0.167.0 or later. Sanitize user-supplied Markdown input to block HTML injection. Implement Content Security Policy (CSP) headers to restrict inline script execution. Monitor rendered pages for unexpected HTML elements or event handlers.

Hi! I’m here to help you understand CVE-2026-109597. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70