The vulnerability is a stored cross‑site scripting flaw in Hugo versions 0.75.0 through 0.165.x. The syntax highlighter fails to escape the lineAnchors option before passing it to Chroma, which writes the value verbatim into the id and href attributes of the generated line‑number markup. A crafted lineAnchors value supplied as a Markdown code fence attribute (or via the highlight template function) results in unescaped HTML in the rendered page, allowing an attacker to inject arbitrary JavaScript that runs in the browsers of visitors to the generated site. This flaw enables client‑side code execution for anyone who visits a page that contains the malicious code block.

The affected product is the Hugo static site generator, available from gohugoio. Versions 0.75.0 through 0.165.x are impacted. Sites that build and publish Markdown from untrusted contributors are at risk, whereas content that is considered trusted by Hugo is not automatically affected. The fix is addressed in 0.166.0.

The CVSS base score is 5.1, indicating the flaw is of moderate severity from the perspective of the vendor. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting that exploitation is not yet widespread. However, attackers who control content sources can exploit it by embedding a malicious lineAnchors attribute in a Markdown code fence, which is then rendered into the website and causes arbitrary JavaScript to execute in the browsers of visitors. Because the attack requires only content injection and no additional system access, the risk is significant for sites that accept untrusted input.