---
id: CVE-2026-109597
title: >-
  Hugo from v0.60.0 before v0.167.0 contains a stored cross-site scripting
  vulnerability that allows Markdown content authors to inject HTML by supplying
  crafted explicit heading IDs
summary: >-
  Hugo from v0.60.0 before v0.167.0 contains a stored cross-site scripting
  vulnerability that allows Markdown content authors to inject HTML by supplying
  crafted explicit heading IDs. Attackers can break out of the unescaped href
  attribute…
severity: medium
cvss: 5.4
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N'
cwe:
  - CWE-79
vendor: gohugoio
product: hugo
affected:
  - hugo >= 0.60.0 < 0.167.0
patched:
  - hardened_images
published: '2026-10-12'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T19:15:07.947'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-109597'
references:
  - url: 'https://github.com/gohugoio/hugo/security/advisories/GHSA-wcpj-vcvm-j4pg'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/hugo-0.60.0-before-0.167.0-stored-xss-via-table-of-contents-heading-ids
    label: disclosure@vulncheck.com
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-109597.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-109597'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2550088'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-109597'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-109597'
  - url: 'https://access.redhat.com/errata/RHSA-2026:80677'
tags:
  - nvd
  - cve.org
  - csaf
  - vex
  - red-hat
epss: 0.00168
epssPercentile: 0.06105
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-13T15:48:36.946396Z'
ingestedAt: '2026-10-13T00:09:02.613Z'
---

## Overview

Hugo from v0.60.0 before v0.167.0 contains a stored cross-site scripting vulnerability that allows Markdown content authors to inject HTML by supplying crafted explicit heading IDs. Attackers can break out of the unescaped href attribute in .TableOfContents or .Fragments.ToHTML output to inject elements with event handlers into rendered pages.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Vendor advisories

- **RHSA-2026:80677** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-10-12 · [advisory](https://access.redhat.com/errata/RHSA-2026:80677)
- **Red Hat VEX** · Moderate · affected: Red Hat Enterprise Linux 10, Red Hat OpenShift GitOps, Red Hat OpenStack Platform 18.0 · no fix planned: Red Hat Enterprise Linux 10, Red Hat OpenShift GitOps, Red Hat OpenStack Platform 18.0 · updated 2026-10-20 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-109597.json)