Medium severity · published Oct 12, 2026
CVE-2026-109597
Hugo v0.60.0 before v0.167.0 Stored XSS via Table of Contents Heading IDs
5.4
CVSS
0.2%
EPSS
No
On KEV
Description
Hugo from v0.60.0 before v0.167.0 contains a stored cross-site scripting vulnerability that allows Markdown content authors to inject HTML by supplying crafted explicit heading IDs. Attackers can break out of the unescaped href attribute in .TableOfContents or .Fragments.ToHTML output to inject elements with event handlers into rendered pages.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 6% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
HU
hugo · gohugoio
0.60.0 before 0.167.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-109597
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-109597
vendor-advisory
https://github.com/gohugoio/hugo/security/advisories/GHSA-wcpj-vcvm-j4pg
third-party-advisory
https://www.vulncheck.com/advisories/hugo-0.60.0-before-0.167.0-stored-xss-via-table-of-contents-heading-ids
More from hugo
9.8
CVE-2026-89259
Hugo before v0.165.0 Insufficient Permission Restriction via TailwindCSS
8.6
CVE-2026-75926
Hugo 0.162.0 to 0.164.x - Node Permission Model Bypass via Default TailwindCSS Child-Process Grant
8.4
CVE-2026-100693
Hugo v0.162.0 before v0.166.0 IP-literal Deny Rule Bypass
8.1
CVE-2026-44301
Hugo: Node tool execution allows file system access outside the project directory
7.5
CVE-2026-100692
Hugo before v0.166.0 Path Traversal via Symlinked Mount Roots