CVE-2026-109597

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-109597", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-10-12T20:59:18.909Z", "datePublished": "2026-10-12T22:21:51.941Z", "dateUpdated": "2026-10-13T16:46:06.110Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-10-12T22:21:51.941Z"}, "datePublic": "2026-09-28T00:00:00.000Z", "title": "Hugo v0.60.0 before v0.167.0 Stored XSS via Table of Contents Heading IDs", "descriptions": [{"lang": "en", "value": "Hugo from v0.60.0 before v0.167.0 contains a stored cross-site scripting vulnerability that allows Markdown content authors to inject HTML by supplying crafted explicit heading IDs. Attackers can break out of the unescaped href attribute in .TableOfContents or .Fragments.ToHTML output to inject elements with event handlers into rendered pages."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "affected": [{"vendor": "gohugoio", "product": "hugo", "defaultStatus": "unaffected", "packageURL": "pkg:golang/github.com/gohugoio/hugo", "versions": [{"version": "0.60.0", "status": "affected", "versionType": "semver", "lessThan": "0.167.0"}, {"version": "0.167.0", "status": "unaffected", "versionType": "semver"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:gohugo:hugo:*:*:*:*:*:*:*:*", "versionStartIncluding": "0.60.0", "versionEndExcluding": "0.167.0"}]}]}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 5.1, "baseSeverity": "MEDIUM", "exploitMaturity": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "LOW", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS"}, {"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "format": "CVSS"}], "references": [{"url": "https://github.com/gohugoio/hugo/security/advisories/GHSA-wcpj-vcvm-j4pg", "tags": ["vendor-advisory"], "name": "GitHub Security Advisory (GHSA-wcpj-vcvm-j4pg)"}, {"name": "VulnCheck Advisory: Hugo v0.60.0 before v0.167.0 Stored XSS via Table of Contents Heading IDs", "tags": ["third-party-advisory"], "url": "https://www.vulncheck.com/advisories/hugo-0.60.0-before-0.167.0-stored-xss-via-table-of-contents-heading-ids"}], "credits": [{"lang": "en", "value": "White0xdi3", "type": "finder"}], "x_generator": {"engine": "vulncheck-endgame"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-10-13T15:48:36.946396Z", "id": "CVE-2026-109597", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-13T16:46:06.110Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"cna": {"title": "Hugo v0.60.0 before v0.167.0 Stored XSS via Table of Contents Heading IDs", "credits": [{"lang": "en", "type": "finder", "value": "White0xdi3"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.1, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "vulnConfidentialityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}}, {"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "gohugoio", "product": "hugo", "versions": [{"status": "affected", "version": "0.60.0", "lessThan": "0.167.0", "versionType": "semver"}, {"status": "unaffected", "version": "0.167.0", "versionType": "semver"}], "packageURL": "pkg:golang/github.com/gohugoio/hugo", "defaultStatus": "unaffected"}], "datePublic": "2026-09-28T00:00:00.000Z", "references": [{"url": "https://github.com/gohugoio/hugo/security/advisories/GHSA-wcpj-vcvm-j4pg", "name": "GitHub Security Advisory (GHSA-wcpj-vcvm-j4pg)", "tags": ["vendor-advisory"]}, {"url": "https://www.vulncheck.com/advisories/hugo-0.60.0-before-0.167.0-stored-xss-via-table-of-contents-heading-ids", "name": "VulnCheck Advisory: Hugo v0.60.0 before v0.167.0 Stored XSS via Table of Contents Heading IDs", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "vulncheck-endgame"}, "descriptions": [{"lang": "en", "value": "Hugo from v0.60.0 before v0.167.0 contains a stored cross-site scripting vulnerability that allows Markdown content authors to inject HTML by supplying crafted explicit heading IDs. Attackers can break out of the unescaped href attribute in .TableOfContents or .Fragments.ToHTML output to inject elements with event handlers into rendered pages."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:gohugo:hugo:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "0.167.0", "versionStartIncluding": "0.60.0"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-10-12T22:21:51.941Z"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-109597", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-13T15:48:36.946396Z"}}}], "providerMetadata": {"shortName": "CISA-ADP", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "dateUpdated": "2026-10-13T15:48:38.234Z"}}]}, "cveMetadata": {"cveId": "CVE-2026-109597", "state": "PUBLISHED", "dateUpdated": "2026-10-12T22:21:51.941Z", "dateReserved": "2026-10-12T20:59:18.909Z", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "datePublished": "2026-10-12T22:21:51.941Z", "assignerShortName": "VulnCheck"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "packageURL": "pkg:golang/github.com/gohugoio/hugo", "product": "hugo", "vendor": "gohugoio", "versions": [{"lessThan": "0.167.0", "status": "affected", "version": "0.60.0", "versionType": "semver"}, {"status": "unaffected", "version": "0.167.0", "versionType": "semver"}]}], "source": "disclosure@vulncheck.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Hugo from v0.60.0 before v0.167.0 contains a stored cross-site scripting vulnerability that allows Markdown content authors to inject HTML by supplying crafted explicit heading IDs. Attackers can break out of the unescaped href attribute in .TableOfContents or .Fragments.ToHTML output to inject elements with event handlers into rendered pages."}], "id": "CVE-2026-109597", "lastModified": "2026-10-16T19:15:07.947", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 2.7, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 5.1, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "LOW", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-109597", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-10-13T15:48:36.946396Z", "version": "2.0.3"}}]}, "published": "2026-10-12T23:17:23.183", "references": [{"source": "disclosure@vulncheck.com", "url": "https://github.com/gohugoio/hugo/security/advisories/GHSA-wcpj-vcvm-j4pg"}, {"source": "disclosure@vulncheck.com", "url": "https://www.vulncheck.com/advisories/hugo-0.60.0-before-0.167.0-stored-xss-via-table-of-contents-heading-ids"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "disclosure@vulncheck.com", "type": "Secondary"}]}

{"bugzilla": {"description": "hugo: Hugo: Stored cross-site scripting via crafted heading identifiers", "id": "2550088", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2550088"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.4", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "status": "draft"}, "cwe": "CWE-79", "details": ["Hugo from v0.60.0 before v0.167.0 contains a stored cross-site scripting vulnerability that allows Markdown content authors to inject HTML by supplying crafted explicit heading IDs. Attackers can break out of the unescaped href attribute in .TableOfContents or .Fragments.ToHTML output to inject elements with event handlers into rendered pages.", "A flaw was found in Hugo. An attacker with permissions to author Markdown content can exploit this stored cross-site scripting (XSS) vulnerability by supplying crafted heading identifiers. When Hugo generates a table of contents or heading fragments, the unescaped attributes allow arbitrary HTML and event handlers to be injected into rendered web pages. This issue may allow malicious scripts to run in the context of a visiting user's browser session."], "mitigation": {"lang": "en:us", "value": "Sanitize author-submitted Markdown files or restrict untrusted contributors from defining custom explicit heading identifiers. Alternatively, avoid calling .TableOfContents or .Fragments.ToHTML within site layout templates."}, "name": "CVE-2026-109597", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "grafana", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Not affected", "package_name": "grafana12.4", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Not affected", "package_name": "grafana13.1", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Not affected", "package_name": "grafana13.2", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Affected", "package_name": "hugo", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:openshift_gitops:1", "fix_state": "Fix deferred", "package_name": "openshift-gitops-1/argocd-rhel9", "product_name": "Red Hat OpenShift GitOps"}, {"cpe": "cpe:/a:redhat:openstack:18.0", "fix_state": "Fix deferred", "package_name": "rhoso-operators/openstack-operator-bundle", "product_name": "Red Hat OpenStack Platform 18.0"}], "public_date": "2026-10-12T22:21:51Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-109597\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-109597\nhttps://github.com/gohugoio/hugo/security/advisories/GHSA-wcpj-vcvm-j4pg\nhttps://www.vulncheck.com/advisories/hugo-0.60.0-before-0.167.0-stored-xss-via-table-of-contents-heading-ids"], "statement": "A flaw was found in Hugo when rendering Markdown heading identifiers into table of contents and fragment HTML structures (.TableOfContents or .Fragments.ToHTML). Hugo fails to sanitize or escape explicit heading IDs before embedding them into anchor href attributes. An attacker with permissions to author or commit Markdown content can supply crafted heading identifiers to break out of the attribute context and inject arbitrary HTML elements and event handlers, resulting in stored cross-site scripting (XSS) executing in the browser context of visiting users.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0.60.0,0.167.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "0.167.0"}}], "enrichment": {"confidence": 92.0, "confidence_source": "matching", "scores": [{"score": 92.0, "source": "matching"}]}, "original": {"product": "hugo", "source": "cna", "vendor": "gohugoio"}, "product": "hugo", "vendor": "gohugo"}], "created": "2026-10-13T00:00:16.561975+00:00", "updated": "2026-10-13T07:15:15.322542+00:00", "vendors": ["gohugo", "gohugo$PRODUCT$hugo"]}