https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 30 Sep 2026 16:59:01 +0000 https://vulnerability.circl.lu/vuln/fkie_cve-2026-100691 <p>Hugo versions 0.75.0 through 0.165.x contain a stored cross-site scripting vulnerability: the syntax highlighter does not escape the `lineAnchors` option before passing it to Chroma, which writes the value verbatim into the `id` and `href` attributes of the generated line-number markup. A crafted `lineAnchors` value supplied as a Markdown code fence attribute (or passed to the `highlight` template function) results in unescaped HTML in the rendered page, allowing arbitrary JavaScript to execute in the browsers of visitors to the generated site. This affects sites that build and publish Markdown from untrusted contributors; Hugo&#39;s security model otherwise considers content trusted input. Fixed in 0.166.0, where the `lineAnchors` value is HTML-escaped before being passed to Chroma.</p> <p>Hugo versions 0.75.0 through 0.165.x contain a stored cross-site scripting vulnerability: the syntax highlighter does not escape the `lineAnchors` option before passing it to Chroma, which writes the value verbatim into the `id` and `href` attributes of the generated line-number markup. A crafted `lineAnchors` value supplied as a Markdown code fence attribute (or passed to the `highlight` template function) results in unescaped HTML in the rendered page, allowing arbitrary JavaScript to execute in the browsers of visitors to the generated site. This affects sites that build and publish Markdown from untrusted contributors; Hugo&#39;s security model otherwise considers content trusted input. Fixed in 0.166.0, where the `lineAnchors` value is HTML-escaped before being passed to Chroma.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-100691 https://vulnerability.circl.lu/vuln/ghsa-8v94-8989-vc79 <p>Hugo versions 0.75.0 through 0.165.x contain a stored cross-site scripting vulnerability: the syntax highlighter does not escape the `lineAnchors` option before passing it to Chroma, which writes the value verbatim into the `id` and `href` attributes of the generated line-number markup. A crafted `lineAnchors` value supplied as a Markdown code fence attribute (or passed to the `highlight` template function) results in unescaped HTML in the rendered page, allowing arbitrary JavaScript to execute in the browsers of visitors to the generated site. This affects sites that build and publish Markdown from untrusted contributors; Hugo&#39;s security model otherwise considers content trusted input. Fixed in 0.166.0, where the `lineAnchors` value is HTML-escaped before being passed to Chroma.</p> <p>Hugo versions 0.75.0 through 0.165.x contain a stored cross-site scripting vulnerability: the syntax highlighter does not escape the `lineAnchors` option before passing it to Chroma, which writes the value verbatim into the `id` and `href` attributes of the generated line-number markup. A crafted `lineAnchors` value supplied as a Markdown code fence attribute (or passed to the `highlight` template function) results in unescaped HTML in the rendered page, allowing arbitrary JavaScript to execute in the browsers of visitors to the generated site. This affects sites that build and publish Markdown from untrusted contributors; Hugo&#39;s security model otherwise considers content trusted input. Fixed in 0.166.0, where the `lineAnchors` value is HTML-escaped before being passed to Chroma.</p> https://vulnerability.circl.lu/vuln/ghsa-8v94-8989-vc79 https://vulnerability.circl.lu/vuln/rhsa-2026:66266 <p>hugo: github.com/gohugoio/hugo: Hugo: Server-Side Request Forgery (SSRF) leading to information disclosure. github.com/gohugoio/hugo: Hugo: Stored Cross-Site Scripting via unescaped code-fence attribute values golang.org/x/image: golang.org/x/image: Denial of Service due to excessive memory allocation when parsing malicious font files github.com/gohugoio/hugo: Hugo: Arbitrary file read via symbolic link sandbox escape github.com/gohugoio/hugo: Hugo: Stored cross-site scripting via unescaped lineAnchors option github.com/gohugoio/hugo: Hugo: Information disclosure via symlinked mount roots github.com/gohugoio/hugo: Hugo: Security restriction bypass via mixed-case URL schemes github.com/gohugoio/hugo: Hugo: Cross-site scripting via unescaped HTML in Org Mode content</p> <p>hugo: github.com/gohugoio/hugo: Hugo: Server-Side Request Forgery (SSRF) leading to information disclosure. github.com/gohugoio/hugo: Hugo: Stored Cross-Site Scripting via unescaped code-fence attribute values golang.org/x/image: golang.org/x/image: Denial of Service due to excessive memory allocation when parsing malicious font files github.com/gohugoio/hugo: Hugo: Arbitrary file read via symbolic link sandbox escape github.com/gohugoio/hugo: Hugo: Stored cross-site scripting via unescaped lineAnchors option github.com/gohugoio/hugo: Hugo: Information disclosure via symlinked mount roots github.com/gohugoio/hugo: Hugo: Security restriction bypass via mixed-case URL schemes github.com/gohugoio/hugo: Hugo: Cross-site scripting via unescaped HTML in Org Mode content</p> https://vulnerability.circl.lu/vuln/rhsa-2026:66266 https://vulnerability.circl.lu/vuln/ubuntu-cve-2026-100691 <p><strong>Affected:</strong> Ubuntu:16.04:LTS: hugo, Ubuntu:18.04:LTS: hugo, Ubuntu:20.04:LTS: hugo, Ubuntu:22.04:LTS: hugo, Ubuntu:Pro:24.04:LTS: hugo, Ubuntu:26.04:LTS: hugo</p> <p>Hugo versions 0.75.0 through 0.165.x contain a stored cross-site scripting vulnerability: the syntax highlighter does not escape the `lineAnchors` option before passing it to Chroma, which writes the value verbatim into the `id` and `href` attributes of the generated line-number markup. A crafted `lineAnchors` value supplied as a Markdown code fence attribute (or passed to the `highlight` template function) results in unescaped HTML in the rendered page, allowing arbitrary JavaScript to execute in the browsers of visitors to the generated site. This affects sites that build and publish Markdown from untrusted contributors; Hugo&#39;s security model otherwise considers content trusted input. Fixed in 0.166.0, where the `lineAnchors` value is HTML-escaped before being passed to Chroma.</p> <p><strong>Affected:</strong> Ubuntu:16.04:LTS: hugo, Ubuntu:18.04:LTS: hugo, Ubuntu:20.04:LTS: hugo, Ubuntu:22.04:LTS: hugo, Ubuntu:Pro:24.04:LTS: hugo, Ubuntu:26.04:LTS: hugo</p> <p>Hugo versions 0.75.0 through 0.165.x contain a stored cross-site scripting vulnerability: the syntax highlighter does not escape the `lineAnchors` option before passing it to Chroma, which writes the value verbatim into the `id` and `href` attributes of the generated line-number markup. A crafted `lineAnchors` value supplied as a Markdown code fence attribute (or passed to the `highlight` template function) results in unescaped HTML in the rendered page, allowing arbitrary JavaScript to execute in the browsers of visitors to the generated site. This affects sites that build and publish Markdown from untrusted contributors; Hugo&#39;s security model otherwise considers content trusted input. Fixed in 0.166.0, where the `lineAnchors` value is HTML-escaped before being passed to Chroma.</p> https://vulnerability.circl.lu/vuln/ubuntu-cve-2026-100691