---
id: CVE-2026-109597
title: >-
  Hugo from v0.60.0 before v0.167.0 contains a stored cross-site scripting
  vulnerability that allows Markdown content authors to inject HTML by supplying
  crafted explicit heading IDs
summary: >-
  Hugo from v0.60.0 before v0.167.0 contains a stored cross-site scripting
  vulnerability that allows Markdown content authors to inject HTML by supplying
  crafted explicit heading IDs. Attackers can break out of the unescaped href
  attribute…
severity: medium
cvss: 5.4
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N'
cwe:
  - CWE-79
published: '2026-10-12'
updated: '2026-10-12'
sourceUpdated: '2026-10-12T23:17:23.183'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-109597'
references:
  - url: 'https://github.com/gohugoio/hugo/security/advisories/GHSA-wcpj-vcvm-j4pg'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/hugo-0.60.0-before-0.167.0-stored-xss-via-table-of-contents-heading-ids
    label: disclosure@vulncheck.com
tags:
  - nvd
ingestedAt: '2026-10-13T00:09:02.613Z'
---

## Overview

Hugo from v0.60.0 before v0.167.0 contains a stored cross-site scripting vulnerability that allows Markdown content authors to inject HTML by supplying crafted explicit heading IDs. Attackers can break out of the unescaped href attribute in .TableOfContents or .Fragments.ToHTML output to inject elements with event handlers into rendered pages.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.