{"id":"GO-2026-5504","revision":"f5363252479b44068a73d2876e49c980","records":[{"revision":"f5363252479b44068a73d2876e49c980","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GO-2026-5504","aliases":["CVE-2026-35166","GHSA-mcv8-8m8x-48pg"],"title":"Hugo: Certain markdown links are not properly escaped in github.com/gohugoio/hugo","description":"Hugo: Certain markdown links are not properly escaped in github.com/gohugoio/hugo","state":0,"publishedAt":"2026-07-07T16:52:19+00:00","modifiedAt":"2026-07-07T20:30:13.6458359+00:00","affected":[{"ecosystem":"Go","name":"github.com/gohugoio/hugo","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0.60.0"},{"kind":"fixed","version":"0.159.2"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://github.com/gohugoio/hugo/security/advisories/GHSA-mcv8-8m8x-48pg","https://github.com/gohugoio/hugo/commit/479fe6c654937a850b65e74551dc4e857d52898f"],"sourceUrl":"https://osv.dev/vulnerability/GO-2026-5504","license":"OSV · upstream source license applies","key":"osv:GO-2026-5504","identifiers":["GO-2026-5504","CVE-2026-35166","GHSA-mcv8-8m8x-48pg"]},"retained":false,"historicalAffected":[]}],"coverage":[]}