{"id":"CVE-2026-109597","title":"Hugo from v0.60.0 before v0.167.0 contains a stored cross-site scripting vulnerability that allows Markdown content authors to inject HTML by supplying crafted explicit heading IDs","summary":"Hugo from v0.60.0 before v0.167.0 contains a stored cross-site scripting vulnerability that allows Markdown content authors to inject HTML by supplying crafted explicit heading IDs. Attackers can break out of the unescaped href attribute…","severity":"medium","cvss":5.4,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","cwe":["CWE-79"],"vendor":"gohugoio","product":"hugo","affected":["hugo >= 0.60.0 < 0.167.0"],"patched":["hardened_images"],"published":"2026-10-12","updated":"2026-10-16","sourceUpdated":"2026-10-16T19:15:07.947","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109597","references":[{"url":"https://github.com/gohugoio/hugo/security/advisories/GHSA-wcpj-vcvm-j4pg","label":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/hugo-0.60.0-before-0.167.0-stored-xss-via-table-of-contents-heading-ids","label":"disclosure@vulncheck.com"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-109597.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-109597"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2550088"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-109597"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109597"},{"url":"https://access.redhat.com/errata/RHSA-2026:80677"}],"tags":["nvd","cve.org","csaf","vex","red-hat"],"epss":0.00168,"epssPercentile":0.06105,"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-10-13T15:48:36.946396Z"},"ingestedAt":"2026-10-13T00:09:02.613Z","slug":"CVE-2026-109597","body":"## Overview\n\nHugo from v0.60.0 before v0.167.0 contains a stored cross-site scripting vulnerability that allows Markdown content authors to inject HTML by supplying crafted explicit heading IDs. Attackers can break out of the unescaped href attribute in .TableOfContents or .Fragments.ToHTML output to inject elements with event handlers into rendered pages.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Vendor advisories\n\n- **RHSA-2026:80677** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-10-12 · [advisory](https://access.redhat.com/errata/RHSA-2026:80677)\n- **Red Hat VEX** · Moderate · affected: Red Hat Enterprise Linux 10, Red Hat OpenShift GitOps, Red Hat OpenStack Platform 18.0 · no fix planned: Red Hat Enterprise Linux 10, Red Hat OpenShift GitOps, Red Hat OpenStack Platform 18.0 · updated 2026-10-20 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-109597.json)","depth":"sunlit","depthScore":30,"depthScoreParts":{"impact":29.7,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}