Medium severity · published Apr 6, 2026
CVE-2026-35166
Hugo does not properly escape some Markdown links
5.4
CVSS
0.2%
EPSS
No
On KEV
Description
Hugo is a static site generator. From 0.60.0 to before 0.159.2, links and image links in the default markdown to HTML renderer are not properly escaped. Hugo users who trust their Markdown content or have custom render hooks for links and images are not affected. This vulnerability is fixed in 0.159.2.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 8% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
HU
hugo · gohugoio
>= 0.60.0, < 0.159.2 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-35166
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-35166
Vendor Advisory
https://github.com/gohugoio/hugo/security/advisories/GHSA-mcv8-8m8x-48pg
More from hugo
9.8
CVE-2026-89259
Hugo before v0.165.0 Insufficient Permission Restriction via TailwindCSS
8.6
CVE-2026-75926
Hugo 0.162.0 to 0.164.x - Node Permission Model Bypass via Default TailwindCSS Child-Process Grant
8.4
CVE-2026-100693
Hugo v0.162.0 before v0.166.0 IP-literal Deny Rule Bypass
8.1
CVE-2026-44301
Hugo: Node tool execution allows file system access outside the project directory
7.5
CVE-2026-100692
Hugo before v0.166.0 Path Traversal via Symlinked Mount Roots