Hugo EUVD-2026-87664

Requires a Hugo site that builds and publishes Markdown from untrusted contributors - the attacker must be able to author or influence page content (a Markdown code fence with a crafted lineAnchors attribute, or a call to the highlight template function with an attacker-controlled lineAnchors value). Affected versions are 0.75.0 through 0.165.x with the syntax highlighter (Chroma-backed code highlighting with line numbers/line anchors) in use. Exploitation is limited by: the need for contributor-level content access (CVSS PR:L), passive victim interaction (a visitor must load the rendered page, UI:P), and Hugo's security model which treats content as trusted - so single-author or fully-trusted-source sites are not realistically at risk. Impact is confined to visitors' browsers (subsequent-system SC:L/SI:L); the build host and Hugo process itself are not compromised.

This is a genuine but low-urgency issue. The vendor CVSS 4.0 score of 5.1 (MEDIUM) is consistent with the mechanism: a stored XSS that requires an authenticated/privileged content contributor (PR:L) and passive victim interaction (UI:P), yielding only subsequent-system impact (SC:L/SI:L) - i.e. script execution in site-visitor browsers, not compromise of the Hugo build host. No EPSS score, no CISA KEV listing, and no public POC were provided, so exploitation is: no public exploit identified at time of analysis. The dominant limiting factor is Hugo's own security model, which explicitly treats content as trusted input - meaning this only matters for sites that build and publish Markdown authored by untrusted contributors (e.g. multi-author docs sites, community wikis, PR-driven blogs). This is a real priority ONLY for such multi-contributor deployments; for the common single-author/trusted-source Hugo site it is effectively non-exploitable. No signals conflict: the CVSS 4.0 vector (network AV:N, low complexity, privileges required, passive UI) aligns cleanly with the description's stored-XSS-via-contributed-content narrative.

A malicious or compromised contributor to a Hugo-built site (e.g. via a pull request or CMS entry) submits a Markdown code fence whose lineAnchors attribute contains an HTML/JavaScript payload; because Hugo passes it to Chroma unescaped, it lands verbatim in the line-number markup's id/href attributes. When the site is rebuilt and published, any visitor who loads the affected page executes the attacker's JavaScript in their browser. No public exploit code is identified, but the technique is straightforward for anyone who can influence page content.