CVE-2026-35166

CVE-2026-35166 affects Hugo static site generator versions 0.60.0 through 0.159.1, where the default markdown to HTML renderer fails to properly escape links and image links, potentially allowing injection attacks. Users who validate their markdown content or implement custom render hooks are not vulnerable. The vulnerability was remediated in version 0.159.2. The vulnerability carries a CVSS score of 5.4 (MEDIUM severity) with a network-based attack vector requiring low complexity and user interaction. The attack requires authentication privileges and can result in limited confidentiality and integrity impacts with no availability impact. The FAUCET Risk Score of 41.0/100 indicates moderate concern within the vulnerability landscape. There is currently no evidence of active exploitation or publicly available exploit code. The vulnerability does not appear on the known exploited vulnerabilities (KEV) catalog and is inactive on vulnerability hot lists. The extremely low EPSS score of 0.000100000 suggests minimal practical exploitation likelihood, though organizations running affected versions should apply the 0.159.2 update as part of routine patching cycles.