Hugo, a widely used static site generator, failed to escape certain Markdown links and image links in its default renderer from version 0.60.0 through just before 0.159.2. This flaw allows an attacker to embed raw HTML or JavaScript via malicious Markdown links when the content is rendered, potentially enabling cross‑site scripting attacks against visitors of the generated site. The vulnerability is most relevant for sites that trust untrusted Markdown input and do not employ custom rendering hooks.

Vulnerable versions of the gohugoio Hugo product span from 0.60.0 up to 0.159.1, inclusive. Users who trust their Markdown content or use custom link and image render hooks are not affected. Any site that relies on the default rendering of untrusted Markdown falls under risk.

The vulnerability carries a CVSS base score of 5.3, denoting moderate severity, with no EPSS score available and it is not present in the CISA KEV catalog. Attackers can trigger the issue by injecting crafted Markdown containing malicious links or images into the Hugo build process, typically through content management systems or manual content editing, leading to execution of arbitrary client‑side code.