CVE catalog

CVE-2026-100691

Hugo versions 0.75.0 through 0.165.x contain a stored cross-site scripting vulnerability: the syntax highlighter does not escape the `lineAnchors` option before passing it to Chroma, which writes the

[CVE catalog]

Severity: Medium · CVSS 5.4CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Published: Sep 9, 2026, 11:14:36 PM UTC
Updated: Sep 26, 2026, 2:16:53 PM UTC
Source: [NVD] · [CVE record]
EPSS: 0.17% · Oct 25, 2026

Hugo versions 0.75.0 through 0.165.x contain a stored cross-site scripting vulnerability: the syntax highlighter does not escape the `lineAnchors` option before passing it to Chroma, which writes the value verbatim into the `id` and `href` attributes of the generated line-number markup. A crafted `lineAnchors` value supplied as a Markdown code fence attribute (or passed to the `highlight` template function) results in unescaped HTML in the rendered page, allowing arbitrary JavaScript to execute in the browsers of visitors to the generated site. This affects sites that build and publish Markdown from untrusted contributors; Hugo's security model otherwise considers content trusted input. Fixed in 0.166.0, where the `lineAnchors` value is HTML-escaped before being passed to Chroma.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	hugo	sid	`0.168.0-3`	fixed
Debian	hugo	forky	`0.167.0-7`	fixed
Debian	hugo	trixie	`0.131.0-1`	vulnerable
Debian	hugo	bookworm	`0.111.3-1`	vulnerable
Cpe	hugo	Not reported	`0.166.0`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	hugo	source	sid	`0.166.0-1`	not yet assigned	Not reported	Not reported
Debian	hugo	source	forky	`0.166.0-1`	not yet assigned	Not reported	Not reported
Debian	hugo	source	trixie	`(unfixed)`	not yet assigned	Not reported	Not reported
Debian	hugo	source	bookworm	`(unfixed)`	not yet assigned	Not reported	Not reported
Cpe	hugo	cpe	Not reported	`0.166.0`	Not reported	NVD-CVE-2026-100691	Not reported

Notes

[trixie] hugo: Minor issue [bookworm] hugo: Limited support, minor issue; unescaped lineAnchors, needs untrusted authors

OpenFactory catalog packages

[Debian 12 (Bookworm)]

[hugo]Affected
Details (2)
- 0.111.3-1 · amd64 · bookworm
  Affected
  nvd · hugo · debian · bookworm; nvd · hugo · debian · 12
- 0.111.3-1 · arm64 · bookworm
  Affected
  nvd · hugo · debian · bookworm; nvd · hugo · debian · 12

[Debian 13 (Trixie)]

[hugo]Affected
Details (2)
- 0.131.0-1 · amd64 · trixie
  Affected
  nvd · hugo · debian · 13
- 0.131.0-1 · arm64 · trixie
  Affected
  nvd · hugo · debian · 13

Observed: Oct 23, 2026, 9:28:27 PM UTC

References

[Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX]