Description

Hugo versions 0.75.0 through 0.165.x contain a stored cross-site scripting vulnerability: the syntax highlighter does not escape the `lineAnchors` option before passing it to Chroma, which writes the value verbatim into the `id` and `href` attributes of the generated line-number markup. A crafted `lineAnchors` value supplied as a Markdown code fence attribute (or passed to the `highlight` template function) results in unescaped HTML in the rendered page, allowing arbitrary JavaScript to execute in the browsers of visitors to the generated site. This affects sites that build and publish Markdown from untrusted contributors; Hugo's security model otherwise considers content trusted input. Fixed in 0.166.0, where the `lineAnchors` value is HTML-escaped before being passed to Chroma.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.4",
  "pubDate": "2026-09-26T14:16:53.710Z",
  "pubdate": "2026-09-26T14:16:53.710Z",
  "executiveSummary": "A stored cross-site scripting (XSS) vulnerability exists within the Hugo static site generator, specifically impacting the syntax highlighting engine, Chroma.\nThe vulnerability occurs because the 'lineAnchors' option is processed without adequate HTML escaping before being injected into the DOM as part of the generated line-number markup.\nThis flaw allows a malicious actor to inject arbitrary JavaScript payloads into Hugo-rendered content by manipulating 'lineAnchors' values within Markdown code fences or the 'highlight' template function.\nThe impact is significant for environments that allow content submission from untrusted contributors, as the payload will execute in the context of any visitor's browser upon rendering the affected page.\nBy bypassing standard input sanitization, an attacker can hijack user sessions, exfiltrate sensitive data, or perform unauthorized actions on behalf of the victim.\nThis vulnerability is present in versions 0.75.0 through 0.165.x of Hugo.\nThe risk is primarily relevant to sites that publish user-generated content, where the static site build process serves as the trust boundary for executable code.\nSuccessful exploitation requires no prior authentication if the content is ingested via untrusted input streams.",
  "technicalDetails": "The vulnerability resides in the interaction between Hugo's configuration handling and the Chroma syntax highlighting library. Specifically, the 'lineAnchors' configuration parameter is mishandled when generating line-number markup.\nDuring the build process, Hugo parses Markdown code blocks or processes the 'highlight' template function. If a user provides a custom 'lineAnchors' value, this string is passed to the Chroma highlighter to construct 'id' and 'href' attributes for line number elements.\nThe root cause is a lack of input sanitization or HTML escaping for the 'lineAnchors' parameter. Because the value is treated as a trusted string, it is written verbatim into the HTML attributes of the generated markup.\nAn attacker can exploit this by crafting a 'lineAnchors' attribute value that breaks out of the intended HTML attribute context. By injecting characters such as double quotes followed by event handlers (e.g., '\" onmouseover=\"alert(1)\"'), the attacker forces the browser to execute arbitrary JavaScript.\nThe attack flow follows these steps: First, an attacker submits Markdown containing a code fence with a malicious 'lineAnchors' attribute. Second, the Hugo build engine parses this input and passes the unsanitized string to Chroma. Third, Chroma generates an HTML element where the malicious payload is embedded within an 'id' or 'href' attribute. Fourth, the resulting HTML file is served to end-users. Finally, when a visitor navigates to the page, their browser parses the malicious HTML, triggering the injected JavaScript payload within the context of the vulnerable site's origin.\nThis vulnerability is particularly insidious because Hugo's security model historically treats Markdown content as trusted input. Since the static site generator creates the rendered output at build time, the XSS payload becomes persistent ('stored') across all generated pages containing the malicious markup.\nThe scope of impact is broad, as it allows for full JavaScript execution in the client's browser, enabling session token theft, DOM manipulation, and redirection to malicious external domains. Authentication or elevated privileges are not required for the initial payload injection if the platform accepts community-contributed Markdown.\nThe vulnerability persists across all Hugo versions from 0.75.0 through 0.165.x, highlighting a systemic failure in the sanitization pipeline for syntax highlighting parameters.\nPost-exploitation, an attacker gains the ability to interact with any resources accessible to the user's session, effectively escalating the impact from a simple static site display issue to a full compromise of the user's interaction with the web application."
}