Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
Sources: National Vulnerability Database, CISA KEV, Exploit-DB
CVE-2026-100691 Overview
CVE-2026-100691 is a stored cross-site scripting (XSS) vulnerability in Hugo, the Go-based static site generator maintained by gohugo. Versions 0.75.0 through 0.165.x fail to escape the lineAnchors option before passing it to the Chroma syntax highlighter. Chroma writes the raw value into the id and href attributes of generated line-number markup, producing unescaped HTML in rendered pages. Sites that build Markdown from untrusted contributors are exposed to arbitrary JavaScript execution in visitor browsers. The issue is tracked under [CWE-79] and fixed in Hugo 0.166.0.
Critical Impact
Attackers who can submit Markdown to a Hugo-built site can inject stored JavaScript that executes against every visitor of the published page.
Affected Products
- Hugo 0.75.0 through 0.165.x
- Sites using the highlight template function with untrusted input
- Markdown pipelines accepting code fences from external contributors
Discovery Timeline
- 2026-09-26 - CVE-2026-100691 published to NVD
- 2026-09-29 - Last updated in NVD database
Technical Details for CVE-2026-100691
Vulnerability Analysis
Hugo exposes code block attributes that forward configuration to the Chroma syntax highlighter. The lineAnchors option controls the identifier prefix used for anchor links on numbered source lines. Hugo passes this value to Chroma without HTML escaping, and Chroma inserts the string verbatim into both the id and href attributes of the rendered <a> elements wrapping line numbers.
An attacker who submits Markdown containing a crafted code fence can break out of the attribute context and inject arbitrary HTML, including <script> payloads or event handlers. The injected payload is stored in the generated static HTML and executes in every visitor's browser session. Hugo's threat model normally considers content trusted, so sites that publish contributions from external authors inherit this risk.
Root Cause
The root cause is missing output encoding at the boundary between Hugo and Chroma. The lineAnchors parameter flows from Markdown fence attributes or the highlight template function directly into attribute values. Without HTML entity escaping of characters such as ", <, and >, attacker-controlled strings terminate the attribute and introduce new markup.
Attack Vector
Exploitation requires an authenticated or anonymous contributor channel that accepts Markdown content later rendered by Hugo. The attacker provides a fenced code block with a malicious lineAnchors attribute. After the site is rebuilt and deployed, the stored payload executes in the context of the published origin, enabling session theft, defacement, or redirection. Full technical analysis is published in the GitHub Security Advisory GHSA-q4xf-287f-98r8 and the Vulncheck Advisory on Hugo XSS.
Detection Methods for CVE-2026-100691
Indicators of Compromise
- Rendered HTML pages containing <a> or line-number anchors with unexpected ", <, or > characters inside id or href attributes.
- Markdown source files with code fences that specify lineAnchors values containing quotes, angle brackets, or inline event handlers.
- Unexpected outbound script requests from site visitors to attacker-controlled domains.
Detection Strategies
- Scan the Hugo content repository for fenced code blocks matching patterns such as lineAnchors= followed by non-alphanumeric characters.
- Diff generated HTML output before and after builds to flag anchor elements containing script syntax.
- Run Content Security Policy (CSP) in report-only mode to surface inline script execution on published pages.
Monitoring Recommendations
- Log and review all contributor Markdown submissions before build and publish.
- Monitor Hugo build pipelines for version strings below 0.166.0 and alert on drift.
- Track visitor-side JavaScript errors and CSP violation reports for anomalies tied to syntax-highlighted code blocks.
How to Mitigate CVE-2026-100691
Immediate Actions Required
- Upgrade Hugo to version 0.166.0 or later across all build environments and CI/CD pipelines.
- Rebuild and redeploy any site that previously processed untrusted Markdown containing code fences.
- Audit historical content for malicious lineAnchors values and remove or sanitize affected files.
Patch Information
Hugo 0.166.0 resolves the issue by HTML-escaping the lineAnchors value before passing it to Chroma. Review the fix and release notes in the GitHub Security Advisory GHSA-q4xf-287f-98r8.
Workarounds
- Disable or strip the lineAnchors attribute from code fences during Markdown preprocessing.
- Restrict Markdown contributions to trusted authors until the Hugo upgrade is deployed.
- Deploy a strict Content Security Policy that blocks inline scripts and unauthorized script sources on the published site.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
Sources: National Vulnerability Database, CISA KEV, Exploit-DB
