What’s Vulnerable › Vulnerabilities
CVE-2026-35166: Hugo does not properly escape some Markdown links
- Severity: medium (CVSS 5.4 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.2% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-04-06 · updated 2026-10-24
- Weakness: CWE-79
Description
Hugo is a static site generator. From 0.60.0 to before 0.159.2, links and image links in the default markdown to HTML renderer are not properly escaped. Hugo users who trust their Markdown content or have custom render hooks for links and images are not affected. This vulnerability is fixed in 0.159.2.
Affected products
- gohugoio hugo: from 0.60.0 before 0.159.2 — fixed in 0.159.2
How to fix
Upgrade to a fixed version: gohugoio hugo 0.159.2. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-35166 or the next vulnerability affects your stack