CVE-2026-100691

Executive Summary

CVE-2026-100691 is a stored cross-site scripting (XSS) vulnerability in the Hugo static site generator, affecting versions 0.75.0 through 0.165.x. The flaw resides in the syntax highlighter integration: the lineAnchors option is not escaped before being passed to Chroma, resulting in unescaped HTML being written verbatim into the id and href attributes of generated line-number markup. Sites that build and publish Markdown content from untrusted contributors are affected, allowing arbitrary JavaScript execution in the browsers of site visitors. The vulnerability was fixed in Hugo 0.166.0.

Technical Analysis

Hugo is a widely deployed static site generator that renders Markdown content into HTML. Its syntax highlighting functionality delegates to Chroma, a Go-based syntax highlighter. When rendering code blocks, Hugo passes configuration options—including lineAnchors—to Chroma. The lineAnchors option controls the generation of anchor identifiers for individual code lines, which Chroma emits as id and href attribute values in the resulting HTML markup.

The core defect is the absence of HTML escaping on the lineAnchors value before it is forwarded to Chroma. Because Chroma writes the value verbatim into attribute contexts (id and href), an attacker who controls the lineAnchors value can inject characters that break out of the attribute context and introduce arbitrary HTML and JavaScript. This is a classic output-encoding failure mapped to CWE-79 (Improper Neutralization of Input During Web Page Generation).

Two distinct injection vectors exist per the advisory:

1. Markdown code fence attributes — a crafted lineAnchors value supplied as an attribute on a Markdown code fence within contributed content.
2. highlight template function — a crafted lineAnchors value passed to Hugo's highlight template function.

Both vectors converge on the same sink: the unescaped value reaching Chroma and being emitted into generated line-number markup. The security boundary here is significant: Hugo's security model otherwise treats content as trusted input. This means the vulnerability only manifests in workflows where untrusted contributors can supply Markdown that is subsequently built and published. The rendered output is static HTML, but the injected script executes in the browser of any visitor to the generated site—making this a stored (persistent) XSS condition rather than a reflected one.

The CVSS vector AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N reflects that the attack is network-reachable, requires low privileges (a contributor role capable of submitting content), requires user interaction (a victim visiting the page), and crosses a security scope boundary (S:C) because the vulnerable component (build tooling) affects a different security authority (the browser/site visitors). Confidentiality and integrity impacts are low, and there is no availability impact.

Exploitation Scenarios

1) Reconnaissance / target identification. An attacker identifies a target site that (a) is built with Hugo versions 0.75.0 through 0.165.x and (b) accepts Markdown content from external or low-trust contributors—for example, community blogs, documentation portals accepting pull requests, or platforms aggregating user-submitted posts. Version identification may be inferred from generator metadata, build artifacts, or public repository configuration.

2) Triggering the flaw. The attacker submits Markdown content containing a code fence with a crafted lineAnchors attribute, or (where template access is available) supplies a crafted value to the highlight template function. Because the lineAnchors value is not escaped before being passed to Chroma, the value is written verbatim into the id and href attributes of the generated line-number markup.

3) Payload/execution method. The crafted value is constructed at the vulnerability-class level to break out of the attribute context and inject executable script. When the site is built and the page is rendered, the unescaped HTML is served to visitors. The injected JavaScript executes in the browser of any user who loads the affected page—fulfilling the stored XSS condition.

4) Post-exploitation impact. Successful execution allows the attacker to run arbitrary JavaScript in the visitor's browser context. Depending on site configuration, this can enable session/token theft, credential harvesting, drive-by redirects, defacement, or actions performed on behalf of the victim within the site's origin. Because the payload is embedded in published content, it persists across visits until the content is removed or the site is rebuilt from sanitized source.

No public PoC or Nuclei template is available for this CVE. The attack chain above is inferred from the vulnerability class (stored XSS via unescaped attribute injection) and the vendor's description; no exploit code is referenced.

Impact Assessment

The CVSS 3.1 base score is 5.4 (Medium) with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. Key subscores:

• Attack Vector (AV:N): Exploitable over the network.
• Attack Complexity (AC:L): No special conditions beyond content submission and page visitation.
• Privileges Required (PR:L): The attacker needs contributor-level ability to supply Markdown or template input.
• User Interaction (UI:R): A victim must visit the rendered page.
• Scope (S:C): The vulnerable build component impacts a separate security authority—site visitors—which elevates the effective risk.
• Confidentiality/Integrity (C:L/I:L): Limited but real impact to visitor data and page content.
• Availability (A:N): No availability impact.

Blast radius: Any published site built from affected Hugo versions where untrusted contributors can inject Markdown or template input. Because output is static HTML, the injected script is served to every visitor until the content is corrected and the site is rebuilt—amplifying reach relative to a reflected XSS. High-value targets include large documentation sites, community content platforms, and any multi-contributor publishing pipeline. The persistent nature of stored XSS makes it valuable for sustained credential/session harvesting and watering-hole style attacks against a site's user base.

Detection Guidance

Detection focuses on identifying crafted lineAnchors values in source Markdown/templates and anomalous markup—particularly event handlers or unexpected tags—within generated id/href attributes of line-number markup.

Sigma Rule

title: Potential Hugo lineAnchors Stored XSS Injection
id: 8f4c1a2e-3b7d-4c9a-9e21-6d5f0b2a7c11
status: experimental
description: Detects crafted lineAnchors values attempting to inject HTML/JavaScript into Hugo code fence attributes or highlight template calls
author: Threat Intelligence
date: 2026/01/01
logsource:
  category: process_creation
  product: linux
detection:
  keywords:
    - 'lineAnchors'
  suspicious:
    - '<script'
    - 'onerror='
    - 'onload='
    - 'javascript:'
    - '"'
    - "'"
  condition: keywords and suspicious
fields:
  - CommandLine
  - ParentCommandLine
falsepositives:
  - Legitimate documentation discussing lineAnchors or XSS payloads
level: medium

YARA Rule

rule CVE_2026_100691_Hugo_lineAnchors_XSS
{
    meta:
        description = "Detects crafted lineAnchors values attempting HTML/JS injection in Hugo-generated content"
        author = "Threat Intelligence"
        reference = "CVE-2026-100691"
        date = "2026-01-01"
        severity = "medium"

    strings:
        $anchors = "lineAnchors" nocase
        $s1 = "<script" nocase
        $s2 = "onerror=" nocase
        $s3 = "onload=" nocase
        $s4 = "javascript:" nocase
        $s5 = "&#" nocase

    condition:
        $anchors and any of ($s1, $s2, $s3, $s4, $s5)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-100691 Hugo lineAnchors Stored XSS Attempt"; flow:established,to_server; http.method; content:"POST"; http.request_body; content:"lineAnchors"; nocase; pcre:"/lineAnchors[^\n]{0,200}(<script|onerror=|onload=|javascript:)/i"; classtype:web-application-attack; sid:2026100691; rev:1;)

Elastic Detection

sequence by host.id
  [process where process.name in ("hugo", "git") and process.args : "*lineAnchors*"]
  [file where file.path : "*.md" and file.Ext.header_bytes : "*lineAnchors*"]

Splunk SPL Query

index=web OR index=app sourcetype IN ("hugo:*","markdown:*","git:*")
("lineAnchors" OR "lineanchors")
| regex _raw="(?i)lineanchors.{0,200}(<script|onerror=|onload=|javascript:)"
| stats count min(_time) as first_seen max(_time) as last_seen by host, user, source
| where count > 0

Wazuh OSSEC Rule

<group name="web,appsec,hugo,">
  <rule id="100691" level="10">
    <decoded_as>json</decoded_as>
    <match>lineAnchors</match>
    <regex type="pcre2">(?i)lineanchors.{0,200}(&lt;script|onerror=|onload=|javascript:)</regex>
    <description>CVE-2026-100691: Possible Hugo lineAnchors stored XSS injection attempt</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_100691,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). Note the vendor advisory states a fix exists in 0.166.0; however, no patch evidence has been corroborated by tracked sources, so patch confidence remains 0/4.

1) Immediate mitigations

• Restrict who can contribute Markdown content and template inputs; enforce contributor review and least privilege.
• Implement pre-commit or CI validation that rejects lineAnchors values containing HTML metacharacters or event handlers.
• Serve generated sites through a Content Security Policy (CSP) that blocks inline and untrusted scripts, reducing XSS impact.
• Scan existing published content and repositories for suspicious lineAnchors usage and remediate/rebuild as needed.

2) Patch/upgrade steps

• Upgrade Hugo to 0.166.0 or later, where the lineAnchors value is HTML-escaped before being passed to Chroma.
• Rebuild and redeploy all affected sites after upgrading to flush any previously generated malicious markup.
• Verify the deployed build version via generator metadata or build pipeline records.

3) Long-term hardening

• Adopt a content trust model that treats contributor-supplied Markdown as untrusted by default.
• Add automated output-encoding tests for template functions and highlighter options.
• Maintain dependency/version tracking for the static site build toolchain and apply security updates promptly.
• Monitor for new advisories affecting Hugo and Chroma.

References

• NVD — CVE-2026-100691: https://nvd.nist.gov/vuln/detail/CVE-2026-100691
• Hugo project (upstream fix and release notes for 0.166.0): https://github.com/gohugoio/hugo
• CWE-79 — Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'): https://cwe.mitre.org/data/definitions/79.html
• CISA Known Exploited Vulnerabilities Catalog (not listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• FIRST EPSS (not yet scored): https://www.first.org/epss

No known threat actor campaigns or exploit-in-the-wild evidence are associated with CVE-2026-100691 at the time of this report. CISA KEV: NO. No public PoC, exploit code, or Nuclei template is available.