UNKNOWN Go

Hugo: Certain markdown links are not properly escaped

GHSA-mcv8-8m8x-48pg · CVE-2026-35166 · GO-2026-5504

Published · Modified

Description

Impact

Links and image links in the default markdown to HTML renderer are not properly escaped. Hugo users who trust their Markdown content or have custom render hooks for links and images are not affected.

Patches

Patched in v0.159.2

Workarounds

Create custom render hooks for links and images in a Hugo theme/project.

Ready to move

Start Securing

Free, no credit card | First findings in minutes