Is CVE-2026-100691 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-100691 being exploited in the wild.

How severe is CVE-2026-100691?

Medium severity, with a CVSS score of 5.4, published 26 September 2026.

Is there a fix for CVE-2026-100691?

A patch was published on 2026-09-26: Fixed in version 0.166.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-100691 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-100691?

Check whether you run Hugo at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-100691: Hugo stored cross-site scripting in lineAnchors

CVE-2026-100691 · Severity: medium · CVSS 5.4 · Published 2026-09-26

Hugo is a static site generator that converts Markdown content into web pages. When processing Markdown code blocks with a `lineAnchors` option, Hugo fails to escape the input before embedding it into generated HTML, allowing an attacker to inject malicious JavaScript. Sites that build and publish Markdown content from untrusted contributors can be exploited to serve JavaScript payloads to all visitors.

Technologies: Hugo. Vendors: Hugo.

Quick answers

Is CVE-2026-100691 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-100691 being exploited in the wild.
How severe is CVE-2026-100691?: Medium severity, with a CVSS score of 5.4, published 26 September 2026.
Which products and versions are affected?: Hugo 0.75.0 through 0.165.x.
Is there a fix for CVE-2026-100691?: A patch was published on 2026-09-26: Fixed in version 0.166.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-100691 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-100691?: Check whether you run Hugo at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The syntax highlighter in Hugo does not HTML-escape the `lineAnchors` parameter before passing it to the Chroma library, which writes the value directly into `id` and `href` attributes of generated line-number markup. An attacker can supply a crafted `lineAnchors` value as a Markdown code fence attribute or via the `highlight` template function to inject arbitrary HTML and JavaScript. The vulnerability is fixed in version 0.166.0 where the parameter is properly HTML-escaped before use.

Affected products

Hugo Hugo 0.75.0 through 0.165.x

Timeline

2026-09-26: disclosed
2026-09-26: patched: Fixed in version 0.166.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.