What is GHSA-mcv8-8m8x-48pg?

GHSA-mcv8-8m8x-48pg is a security advisory published by GitHub Security Advisories with Medium severity. Hugo: Certain markdown links are not properly escaped

Which CVE IDs does GHSA-mcv8-8m8x-48pg cover?

GHSA-mcv8-8m8x-48pg covers the following CVE IDs: CVE-2026-35166. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

Which products are affected by GHSA-mcv8-8m8x-48pg?

GHSA-mcv8-8m8x-48pg affects 1 product, including: go/github.com/gohugoio/hugo:\u003e= 0.60.0, \u003c 0.159.2.

GHSA-mcv8-8m8x-48pgMedium

Hugo: Certain markdown links are not properly escaped

Vendor

GitHub Security Advisories

Published

April 3, 2026

Last Modified

April 6, 2026

🔗 CVE IDs covered (1)

CVE-2026-35166 →

📋 Description

Impact

Links and image links in the default markdown to HTML renderer are not properly escaped. Hugo users who trust their Markdown content or have custom render hooks for links and images are not affected.

Patches

Patched in v0.159.2

Workarounds

Create custom render hooks for links and images in a Hugo theme/project.

🎯 Affected products1

go/github.com/gohugoio/hugo:>= 0.60.0, < 0.159.2

🔗 References (4)

https://github.com/gohugoio/hugo/security/advisories/GHSA-mcv8-8m8x-48pg
https://github.com/gohugoio/hugo/commit/479fe6c654937a850b65e74551dc4e857d52898f
https://nvd.nist.gov/vuln/detail/CVE-2026-35166
https://github.com/advisories/GHSA-mcv8-8m8x-48pg