CVE-2026-35166Published
Hugo is a static site generator. From 0.60.0 to before 0.159.2, links and image links in the default markdown to HTML renderer are not properly escaped. Hugo users who trust their Markdown content or have custom render hooks for links and i…
Exact source revision recorded 25 Oct 2026 08:17:35 UTC. It does not establish the source's current position. Latest evidence.
nvd · CVE-2026-35166
PublishedNo affected-package array is stated in this source revision. Check its state and earlier observations; this does not establish that every package is unaffected.