CVE-2026-100691
- Source
- https://cve.org/CVERecord?id=CVE-2026-100691
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-100691.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-100691
- Aliases
-
- GHSA-q4xf-287f-98r8
- Downstream
- Published
- 2026-09-26T13:23:50Z
- Modified
- 2026-09-28T03:48:31Z
- Severity
-
- 5.1 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N CVSS Calculator
- Summary
- Hugo before 0.166.0 Stored XSS via lineAnchors code block option
- Details
-
Hugo versions 0.75.0 through 0.165.x contain a stored cross-site scripting vulnerability: the syntax highlighter does not escape the
lineAnchorsoption before passing it to Chroma, which writes the value verbatim into theidandhrefattributes of the generated line-number markup. A craftedlineAnchorsvalue supplied as a Markdown code fence attribute (or passed to thehighlighttemplate function) results in unescaped HTML in the rendered page, allowing arbitrary JavaScript to execute in the browsers of visitors to the generated site. This affects sites that build and publish Markdown from untrusted contributors; Hugo's security model otherwise considers content trusted input. Fixed in 0.166.0, where thelineAnchorsvalue is HTML-escaped before being passed to Chroma. - Database specific
{ "cna_assigner": "VulnCheck", "cwe_ids": [ "CWE-79" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/100xxx/CVE-2026-100691.json" }- References
-
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/100xxx/CVE-2026-100691.json
- https://github.com/gohugoio/hugo/security/advisories/GHSA-q4xf-287f-98r8
- https://nvd.nist.gov/vuln/detail/CVE-2026-100691
- https://www.vulncheck.com/advisories/hugo-before-0.166.0-stored-xss-via-lineanchors-code-block-option