CVE-2026-109597: Hugo Static Site Generator XSS Vulnerability

CVE-2026-109597 Overview

CVE-2026-109597 is a stored cross-site scripting (XSS) vulnerability [CWE-79] in Hugo, the Go-based static site generator maintained by the gohugoio project. The flaw affects versions from v0.60.0 up to but not including v0.167.0. Markdown content authors can inject HTML by supplying crafted explicit heading identifiers. The injected payload breaks out of the unescaped href attribute produced by .TableOfContents or .Fragments.ToHTML, allowing attacker-controlled elements with event handlers to render in published pages.

Critical Impact
Untrusted Markdown contributors can store persistent HTML and JavaScript payloads that execute in the browsers of every visitor to a rendered Hugo site.

Affected Products

Hugo static site generator versions v0.60.0 through versions prior to v0.167.0
Hugo sites that render .TableOfContents output from Markdown content
Hugo sites that use .Fragments.ToHTML to emit heading anchors

Discovery Timeline

2026-10-12 - CVE-2026-109597 published to the National Vulnerability Database (NVD)
2026-10-13 - Last updated in NVD database

Technical Details for CVE-2026-109597

Vulnerability Analysis

Hugo supports explicit heading IDs in Markdown using the {#custom-id} syntax. When Hugo renders a table of contents or heading fragments, it emits anchor tags whose href attribute references the author-supplied identifier. In affected versions, Hugo does not escape the identifier before placing it inside the href attribute of the generated <a> element.

An attacker who can author Markdown content can supply a heading ID containing a double quote followed by additional HTML. The injected content terminates the href attribute and introduces new attributes such as onmouseover or onclick. The payload is stored in the generated static HTML and executes in the browser of every visitor.

Because Hugo is commonly used for documentation sites, blogs, and knowledge bases that accept external Markdown contributions, the vulnerability has broad applicability wherever untrusted content enters the build pipeline.

Root Cause

The root cause is missing output encoding of explicit heading identifiers when Hugo constructs the href attribute inside .TableOfContents and .Fragments.ToHTML. The template rendering path trusts the raw author-supplied ID instead of applying HTML attribute escaping.

Attack Vector

Exploitation requires network-adjacent access to the content pipeline, specifically the ability to submit Markdown. The scenario applies to multi-author sites, pull-request-based documentation workflows, and content management systems that feed Hugo. A visitor who loads the rendered page triggers the payload through standard user interaction, satisfying the user-interaction requirement in the CVSS vector.

See the GitHub Security Advisory GHSA-wcpj-vcvm-j4pg and the VulnCheck Advisory for Hugo XSS for the vendor-published technical details.

Detection Methods for CVE-2026-109597

Indicators of Compromise

Rendered HTML containing anchor tags with unexpected attributes such as onmouseover, onclick, or onerror adjacent to table of contents entries.
Markdown source files containing heading IDs with embedded quote characters, angle brackets, or event handler keywords inside {#...} blocks.
Build artifacts under public/ that include <script> tags or inline event handlers inside <nav> or <ul> elements produced by the TOC template.

Detection Strategies

Scan Markdown repositories for heading ID patterns matching \{#[^}]*["<>][^}]*\} to flag crafted identifiers before build time.
Diff the generated HTML of the TOC region against a known-good baseline to catch unauthorized attribute injections.
Integrate a content security policy (CSP) report-only header during staging builds to surface inline script executions originating from TOC markup.

Monitoring Recommendations

Log and review every pull request that modifies Markdown content with explicit heading IDs.
Alert on web server responses that serve HTML containing event handler attributes within anchor elements generated by Hugo partials.
Track Hugo version strings reported in CI build logs to confirm all pipelines run v0.167.0 or later.

How to Mitigate CVE-2026-109597

Immediate Actions Required

Upgrade Hugo to version v0.167.0 or later across all build environments, including developer workstations and CI runners.
Audit existing Markdown content for crafted heading IDs and rebuild affected sites after upgrading.
Restrict Markdown authoring permissions to trusted contributors until the upgrade is deployed.

Patch Information

The fix is included in Hugo v0.167.0. The patched release properly escapes explicit heading identifiers when generating anchor href attributes in .TableOfContents and .Fragments.ToHTML. Refer to the GitHub Security Advisory GHSA-wcpj-vcvm-j4pg for the authoritative patch notes.

Workarounds

Disable the use of .TableOfContents and .Fragments.ToHTML in site templates until the upgrade is applied.
Strip or validate explicit heading IDs from untrusted Markdown using a pre-commit hook or build-time linter.
Deploy a strict Content Security Policy that blocks inline event handlers to reduce the impact of injected payloads.

bash

# Upgrade Hugo and verify the installed version meets the patched release
hugo version
# Expected output should report v0.167.0 or later, for example:
# hugo v0.167.0+extended linux/amd64 BuildDate=...