CVE-2026-35166 Hugo does not properly escape some Markdown links

Medium 5.3 Published 6 Apr 2026 Updated 6 Apr 2026

Attackers can inject malicious scripts via unescaped Markdown links in Hugo-generated sites, affecting users who do not trust their content.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2026-35166?

CVE-2026-35166 is a medium-severity cross-site scripting vulnerability in gohugoio hugo, published on 6 Apr 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

Hugo is a static site generator. From 0.60.0 to before 0.159.2, links and image links in the default markdown to HTML renderer are not properly escaped. Hugo users who trust their Markdown content or have custom render hooks for links and images are not affected. This vulnerability is fixed in 0.159.2.

Weakness: CWE-79

Which versions are affected by CVE-2026-35166?

3 open source packages ship an affected version, including github.com/gohugoio/hugo. It affects 1 product.

Package	Affected	Fixed in
`github.com/gohugoio/hugo` Go	From `0.60.0`	`0.159.2`
`github.com/gohugoio/hugo` Go	From `0.60.0`	`0.159.2`
`github.com/gohugoio/hugo` Go	From `0.60.0`	`0.159.2`

Linux distribution packages (1)

hugo Red Hat:hummingbird:1 All versions 0:0.160.1-2.hum1

Products include Gohugo Hugo.

How do I fix CVE-2026-35166?

Upgrade github.com/gohugoio/hugo to 0.159.2 or later.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2026-35166 being exploited?

There is no known exploitation of CVE-2026-35166 in the wild and no public exploit code.

Sources

Also known as DEBIAN-CVE-2026-35166, GHSA-mcv8-8m8x-48pg, GO-2026-5504, JLSEC-2026-792, RHSA-2026:7848, UBUNTU-CVE-2026-35166.