Hugo CVE-2026-109597

Requires an attacker with Markdown content-authoring privileges (CVSS PR:L) who can supply crafted explicit heading IDs (e.g. a '{#...}' attribute block on a heading), on a Hugo site at version >= v0.60.0 and < v0.167.0 that renders the .TableOfContents or .Fragments.ToHTML output where the heading ID is placed into an unescaped href attribute. Exploitation is further limited by required victim interaction (UI:P - a user must view the rendered page) and by the deployment pattern: it is only relevant where Hugo processes Markdown from multiple or untrusted authors, not single-author sites built from a fully trusted source repository.

This is a moderate-severity stored XSS (CVSS 4.0 base 5.1, CWE-79) that in practice is a lower-priority issue than its 'network' attack vector might first suggest. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N) is internally consistent with the description: PR:L reflects that the attacker must already be a privileged Markdown content author, UI:P reflects that a victim must view the rendered page, and the impact lands on the subsequent system (SC:L/SI:L - the victim's browser) with no impact to the Hugo build system itself (VC/VI/VA:N). There is no EPSS score, no CISA KEV listing, and no public POC referenced, so by the precision rules this is 'no public exploit identified at time of analysis.' The dominant mitigating factor is the PR:L prerequisite - exploitation is only meaningful where Hugo renders Markdown from multiple or semi-trusted authors (e.g. community docs, multi-contributor sites, or pipelines ingesting externally-supplied Markdown); a single-author blog built from a trusted repository is not realistically at risk. Net: a real but bounded defect, worth patching on multi-author deployments, not an emergency.

On a Hugo site that accepts Markdown from multiple contributors (e.g. a community documentation portal), a malicious author submits a page whose heading uses a crafted explicit ID that breaks out of the unescaped href attribute generated by .TableOfContents or .Fragments.ToHTML. When another user or administrator views the rendered page, the injected element with an event handler executes attacker-controlled JavaScript in their browser. No public exploit code is referenced, but the technique is straightforward given the described attribute-breakout.