Hugo versions 0.75.0 through 0.165.x contain a stored cross-site scripting vulnerability: the syntax highlighter does not escape the `lineAnchors` option before passing it to Chroma, which writes...
Last checked: 2026-09-29 20:36 UTC
No exploitation evidence · CISA Coordinator (Assessed 2026-09-28 17:51 UTC)
Fix evidence last checked: 2026-09-29 04:10 UTC