Executive brief
Hugo is a static site generator that converts Markdown content into web pages. When processing Markdown code blocks with a `lineAnchors` option, Hugo fails to escape the input before embedding it into generated HTML, allowing an attacker to inject malicious JavaScript. Sites that build and publish Markdown content from untrusted contributors can be exploited to serve JavaScript payloads to all visitors.
Technical details
The syntax highlighter in Hugo does not HTML-escape the `lineAnchors` parameter before passing it to the Chroma library, which writes the value directly into `id` and `href` attributes of generated line-number markup. An attacker can supply a crafted `lineAnchors` value as a Markdown code fence attribute or via the `highlight` template function to inject arbitrary HTML and JavaScript. The vulnerability is fixed in version 0.166.0 where the parameter is properly HTML-escaped before use.
Affected products
- Hugo Hugo 0.75.0 through 0.165.x
Timeline
- 2026-09-26: disclosed
- 2026-09-26: patched: Fixed in version 0.166.0