Hugo contains a flaw where Markdown authors can embed custom heading IDs into their content. The content parser then renders these IDs as part of the Table of Contents or fragment output without escaping the href attribute. By injecting malicious markup into the ID, an attacker can close the attribute and embed JavaScript or other elements, which will be served to any user who views the page. The resulting stored XSS can be used to steal credentials, manipulate the DOM, or redirect users, depending on the payload.

The vulnerability applies to the gohugoio Hugo project, affecting releases starting with v0.60.0 and continuing through but excluding v0.167.0. All official binaries, Docker images, and source distributions that have not been upgraded beyond v0.167.0 contain the flaw.

The CVSS score of 5.1 reflects moderate risk, and an EPSS score is not available. The vulnerability is not listed in the CISA KEV catalog. Attackers would need the ability to supply or modify Markdown content, such as through a contributor portal or content editing interface. Once exploited, any user who views the rendered page is impacted, which can affect both anonymous visitors and authenticated users on sites that host user‑generated content.