Hugo: Certain markdown links are not properly escaped

GHSA-mcv8-8m8x-48pg · CVE-2026-35166 · GO-2026-5504

Published Apr 3, 2026 · Modified Jul 7, 2026

AI SAST

Find this class of vulnerability in your own code

Corgea's AI-native static analysis detects vulnerabilities like this one across your repositories, ranks them by exploitability, and returns review-ready fixes.

Explore AI SAST Explore dependency scanning →

Description

Impact

Links and image links in the default markdown to HTML renderer are not properly escaped. Hugo users who trust their Markdown content or have custom render hooks for links and images are not affected.

Patches

Patched in v0.159.2

Workarounds

Create custom render hooks for links and images in a Hugo theme/project.

References

WEB https://github.com/gohugoio/hugo/security/advisories/GHSA-mcv8-8m8x-48pg
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-35166
WEB https://github.com/gohugoio/hugo/commit/479fe6c654937a850b65e74551dc4e857d52898f
PACKAGE https://github.com/gohugoio/hugo

Ready to move

Start Securing

Start for Free Get Demo

Free, no credit card | First findings in minutes