CVE-2026-100691 Hugo before 0.166.0 Stored XSS via lineAnchors code block option
Hugo static site generator allows stored XSS via unescaped lineAnchors in code blocks, enabling JavaScript execution in visitor browsers.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-100691?
CVE-2026-100691 is a medium-severity cross-site scripting vulnerability in gohugoio hugo, published on 26 Sep 2026. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
Hugo versions 0.75.0 through 0.165.x contain a stored cross-site scripting vulnerability: the syntax highlighter does not escape the `lineAnchors` option before passing it to Chroma, which writes the value verbatim into the `id` and `href` attributes of the generated line-number markup. A crafted `lineAnchors` value supplied as a Markdown code fence attribute (or passed to the `highlight` template function) results in unescaped HTML in the rendered page, allowing arbitrary JavaScript to execute in the browsers of visitors to the generated site. This affects sites that build and publish Markdown from untrusted contributors; Hugo's security model otherwise considers content trusted input. Fixed in 0.166.0, where the `lineAnchors` value is HTML-escaped before being passed to Chroma.
Weakness: CWE-79
Which versions are affected by CVE-2026-100691?
It affects 1 product.
Products include Gohugo Hugo.
How do I fix CVE-2026-100691?
Upgrade to a fixed version.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2026-100691 being exploited?
There is no known exploitation of CVE-2026-100691 in the wild and no public exploit code.
Other vulnerabilities in gohugoio hugo
- CVE-2026-75926 Hugo 0.162.0 to 0.164.x - Node Permission Model Bypass via Default TailwindCSS Child-Process Grant
- CVE-2026-100690 Hugo v0.161.0 to v0.165.0 Arbitrary File Read via Symlinks
- CVE-2026-100692 Hugo before v0.166.0 Path Traversal via Symlinked Mount Roots
- CVE-2026-100693 Hugo v0.162.0 before v0.166.0 IP-literal Deny Rule Bypass
- CVE-2020-26284 Hugo can execute a binary from the current directory on Windows
Sources
Also known as DEBIAN-CVE-2026-100691, GHSA-8v94-8989-vc79, GHSA-q4xf-287f-98r8, MINI-6h29-v3fx-96c7, MINI-6v2g-8j4v-cp5c, UBUNTU-CVE-2026-100691.