CVE-2026-35166

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-35166", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-04-01T17:26:21.133Z", "datePublished": "2026-04-06T17:37:05.643Z", "dateUpdated": "2026-04-06T18:02:37.432Z"}, "containers": {"cna": {"title": "Hugo does not properly escape some Markdown links", "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "lang": "en", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "PASSIVE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "LOW", "subAvailabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/gohugoio/hugo/security/advisories/GHSA-mcv8-8m8x-48pg", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/gohugoio/hugo/security/advisories/GHSA-mcv8-8m8x-48pg"}], "affected": [{"vendor": "gohugoio", "product": "hugo", "versions": [{"version": ">= 0.60.0, < 0.159.2", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-06T17:37:05.643Z"}, "descriptions": [{"lang": "en", "value": "Hugo is a static site generator. From 0.60.0 to before 0.159.2, links and image links in the default markdown to HTML renderer are not properly escaped. Hugo users who trust their Markdown content or have custom render hooks for links and images are not affected. This vulnerability is fixed in 0.159.2."}], "source": {"advisory": "GHSA-mcv8-8m8x-48pg", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-06T18:02:26.136376Z", "id": "CVE-2026-35166", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-06T18:02:37.432Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-35166", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-06T18:02:26.136376Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-06T18:02:30.593Z"}}], "cna": {"title": "Hugo does not properly escape some Markdown links", "source": {"advisory": "GHSA-mcv8-8m8x-48pg", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "vulnConfidentialityImpact": "NONE"}}], "affected": [{"vendor": "gohugoio", "product": "hugo", "versions": [{"status": "affected", "version": ">= 0.60.0, < 0.159.2"}]}], "references": [{"url": "https://github.com/gohugoio/hugo/security/advisories/GHSA-mcv8-8m8x-48pg", "name": "https://github.com/gohugoio/hugo/security/advisories/GHSA-mcv8-8m8x-48pg", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "Hugo is a static site generator. From 0.60.0 to before 0.159.2, links and image links in the default markdown to HTML renderer are not properly escaped. Hugo users who trust their Markdown content or have custom render hooks for links and images are not affected. This vulnerability is fixed in 0.159.2."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-06T17:37:05.643Z"}}}, "cveMetadata": {"cveId": "CVE-2026-35166", "state": "PUBLISHED", "dateUpdated": "2026-04-06T18:02:37.432Z", "dateReserved": "2026-04-01T17:26:21.133Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-04-06T17:37:05.643Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "hugo", "vendor": "gohugoio", "versions": [{"status": "affected", "version": ">= 0.60.0, < 0.159.2"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:gohugo:hugo:*:*:*:*:*:linux:*:*", "matchCriteriaId": "D9199A95-23E0-43BE-8F0C-C521A7455819", "versionEndExcluding": "0.159.2", "versionStartIncluding": "0.60.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:gohugo:hugo:*:*:*:*:*:macos:*:*", "matchCriteriaId": "417A61AB-2317-42C3-9961-81C1DFB7C6DB", "versionEndExcluding": "0.159.2", "versionStartIncluding": "0.60.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:gohugo:hugo:*:*:*:*:*:windows:*:*", "matchCriteriaId": "8576A7CA-0166-4BC1-B2C8-CB53588E4CAC", "versionEndExcluding": "0.159.2", "versionStartIncluding": "0.60.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Hugo is a static site generator. From 0.60.0 to before 0.159.2, links and image links in the default markdown to HTML renderer are not properly escaped. Hugo users who trust their Markdown content or have custom render hooks for links and images are not affected. This vulnerability is fixed in 0.159.2."}, {"lang": "es", "value": "pendiente..."}], "id": "CVE-2026-35166", "lastModified": "2026-10-24T13:10:00.147", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "LOW", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-35166", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-06T18:02:26.136376Z", "version": "2.0.3"}}]}, "published": "2026-04-06T18:16:43.060", "references": [{"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/gohugoio/hugo/security/advisories/GHSA-mcv8-8m8x-48pg"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "hugo: github.com/gohugoio/hugo: Hugo: Information disclosure and content manipulation via improper markdown link escaping", "id": "2455512", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2455512"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.6", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N", "status": "draft"}, "cwe": "CWE-79", "details": ["A flaw was found in Hugo, a static site generator. This vulnerability arises from improper escaping of links and image links within the default markdown to HTML renderer. A remote attacker could exploit this by crafting malicious markdown content, potentially leading to information disclosure or content manipulation when processed by a user."], "mitigation": {"lang": "en:us", "value": "To mitigate this issue, ensure that all markdown content processed by Hugo originates from trusted sources. Alternatively, implement custom render hooks for links and images within Hugo to ensure proper escaping, as this configuration prevents exploitation."}, "name": "CVE-2026-35166", "package_state": [{"cpe": "cpe:/a:redhat:kueue_operator:1", "fix_state": "Fix deferred", "package_name": "redhat-user-workloads/kueue-0-11", "product_name": "Red Hat Build of Kueue"}, {"cpe": "cpe:/a:redhat:kueue_operator:1", "fix_state": "Fix deferred", "package_name": "redhat-user-workloads/kueue-0-12", "product_name": "Red Hat Build of Kueue"}, {"cpe": "cpe:/a:redhat:kueue_operator:1", "fix_state": "Fix deferred", "package_name": "redhat-user-workloads/kueue-bundle-1-1", "product_name": "Red Hat Build of Kueue"}, {"cpe": "cpe:/a:redhat:kueue_operator:1", "fix_state": "Fix deferred", "package_name": "redhat-user-workloads/kueue-must-gather-1-1", "product_name": "Red Hat Build of Kueue"}, {"cpe": "cpe:/a:redhat:kueue_operator:1", "fix_state": "Fix deferred", "package_name": "redhat-user-workloads/kueue-operator-1-1", "product_name": "Red Hat Build of Kueue"}, {"cpe": "cpe:/a:redhat:openshift_gitops:1", "fix_state": "Fix deferred", "package_name": "redhat-user-workloads/argocd-rhel8", "product_name": "Red Hat OpenShift GitOps"}, {"cpe": "cpe:/a:redhat:openshift_gitops:1", "fix_state": "Fix deferred", "package_name": "redhat-user-workloads/argocd-rhel9", "product_name": "Red Hat OpenShift GitOps"}, {"cpe": "cpe:/a:redhat:openstack:18.0", "fix_state": "Fix deferred", "package_name": "redhat-user-workloads/openstack-operator-bundle", "product_name": "Red Hat OpenStack Platform 18.0"}], "public_date": "2026-04-06T17:37:05Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-35166\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-35166\nhttps://github.com/gohugoio/hugo/security/advisories/GHSA-mcv8-8m8x-48pg"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0.60.0,0.159.2)"}}], "enrichment": {"confidence": 92.0, "confidence_source": "matching", "scores": [{"score": 92.0, "source": "matching"}]}, "original": {"product": "hugo", "source": "cna", "vendor": "gohugoio"}, "product": "hugo", "vendor": "gohugo"}], "analysis": {"en": {"generated_at": "2026-04-06T21:36:54.421038+00:00", "value": {"mitigation_remediation": ["Upgrade Hugo to version 0.159.2 or later to rectify the escaping issue.", "If an immediate upgrade is not feasible, restrict Markdown input to trusted sources and validate or sanitize links before rendering.", "Verify any custom link or image rendering hooks to ensure they perform proper escaping."], "summary": {"action": "Apply Patch", "impact": "Cross\u2011Site Scripting"}, "threat_synthesis": {"affected_systems": "Vulnerable versions of the gohugoio Hugo product span from 0.60.0 up to 0.159.1, inclusive. Users who trust their Markdown content or use custom link and image render hooks are not affected. Any site that relies on the default rendering of untrusted Markdown falls under risk.", "description_and_impact": "Hugo, a widely used static site generator, failed to escape certain Markdown links and image links in its default renderer from version 0.60.0 through just before 0.159.2. This flaw allows an attacker to embed raw HTML or JavaScript via malicious Markdown links when the content is rendered, potentially enabling cross\u2011site scripting attacks against visitors of the generated site. The vulnerability is most relevant for sites that trust untrusted Markdown input and do not employ custom rendering hooks.", "risk_and_exploitability": "The vulnerability carries a CVSS base score of 5.3, denoting moderate severity, with no EPSS score available and it is not present in the CISA KEV catalog. Attackers can trigger the issue by injecting crafted Markdown containing malicious links or images into the Hugo build process, typically through content management systems or manual content editing, leading to execution of arbitrary client\u2011side code."}}}}, "created": "2026-04-06T21:47:05.282285+00:00", "updated": "2026-04-07T09:38:01.683290+00:00", "vendors": ["gohugo", "gohugo$PRODUCT$hugo"]}