Is there a patch available for CVE-2026-35166?

Yes, a patch is available for CVE-2026-35166. Update the affected software to the latest version immediately.

CVE-2026-35166

Q: What is the CVSS score of CVE-2026-35166?

CVE-2026-35166 has a CVSS 4.0 base score of 5.3 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-04-03 https://github.com/gohugoio/hugo

GHSA-mcv8-8m8x-48pg

XSS

5.3

CVSS 4.0 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

5.3 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

SUSE

4.6 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N

Red Hat

4.6 MEDIUM

qualitative

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Analysis Generated

Apr 04, 2026 - 00:30 vuln.today

Patch released

Apr 04, 2026 - 00:30 nvd

Patch available

CVE Published

Apr 03, 2026 - 23:38 nvd

MEDIUM 5.3

DescriptionGitHub Advisory

Impact

Links and image links in the default markdown to HTML renderer are not properly escaped. Hugo users who trust their Markdown content or have custom render hooks for links and images are not affected.

Patches

Patched in v0.159.2

Workarounds

Create custom render hooks for links and images in a Hugo theme/project.

AnalysisAI

Cross-site scripting (XSS) vulnerability in Hugo's default markdown to HTML renderer fails to properly escape links and image links, allowing injection of malicious scripts through markdown content. Hugo v0.159.2 and earlier are affected. Users who employ custom render hooks for links and images, or who trust all markdown content sources, are not vulnerable. Vendor-released patch: v0.159.2.

Technical ContextAI

Hugo is a static site generator written in Go that processes markdown content and renders it to HTML. The vulnerability resides in the default markdown rendering pipeline (CWE-79: Improper Neutralization of Input During Web Page Generation), where link href attributes and image src attributes derived from untrusted markdown input are not properly HTML-escaped before insertion into the output HTML. This allows an attacker to inject JavaScript or other executable content through specially crafted markdown syntax. The affected component is the core rendering engine for markdown-to-HTML conversion in the github.com/gohugoio/hugo package.

RemediationAI

Vendor-released patch: Hugo v0.159.2 or later. Upgrade to v0.159.2 immediately via 'hugo version' to verify current installation, then update via your package manager or by downloading the latest release from github.com/gohugoio/hugo. Workaround (if immediate upgrade is not feasible): create custom render hooks for links and images in your Hugo theme or project to explicitly escape link and image URLs before rendering. Refer to the GitHub Security Advisory at https://github.com/gohugoio/hugo/security/advisories/GHSA-mcv8-8m8x-48pg and the patch commit at https://github.com/gohugoio/hugo/commit/479fe6c654937a850b65e74551dc4e857d52898f for implementation guidance.