JLSEC-2026-792 Medium 5.3

Hugo: Certain markdown links are not properly escaped

JLSEC Published: Jul 25, 2026
Modified: Jul 25, 2026
Severity: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Affected Packages: Hugo_jll < 0.163.3+0
Upstream: CVE-2026-35166 GHSA-mcv8-8m8x-48pg EUVD-2026-19414

Impact

Links and image links in the default markdown to HTML renderer are not properly escaped. Hugo users who trust their Markdown content or have custom render hooks for links and images are not affected.

Patches

Patched in v0.159.2

Workarounds

Create custom render hooks for links and images in a Hugo theme/project.

References

https://github.com/advisories/GHSA-mcv8-8m8x-48pg
https://github.com/gohugoio/hugo/commit/479fe6c654937a850b65e74551dc4e857d52898f
https://github.com/gohugoio/hugo/security/advisories/GHSA-mcv8-8m8x-48pg
https://nvd.nist.gov/vuln/detail/CVE-2026-35166