Hugo: Certain markdown links are not properly escaped
Date: 2026-04
Affected: go/github.com/gohugoio/hugo
Attack vector: xss
Category: vulnerability-disclosure
Severity: Medium
CVE: CVE-2026-35166
CWE: CWE-79

### Impact Links and image links in the default markdown to HTML renderer are not properly escaped. Hugo users who trust their Markdown content or have custom render hooks for links and images are not affected. ### Patches Patched in v0.159.2 ### Workarounds Create custom render hooks for links and images in a Hugo theme/project.


Mitigations:

Architectural layers (MAESTRO):