Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via the markdown to HTML rendering. An attacker can inject arbitrary scripts by crafting malicious links or image links in markdown content, which may be executed in the context of users viewing the rendered HTM...

PT-2026-30283

Impact Links and image links in the default markdown to HTML renderer are not properly escaped. Hugo users who trust their Markdown content or have custom render hooks for links and images are not affected. Patches Patched in v0.159.2 Workarounds Create custom render hooks for links and images in...