Bug 2550088 (CVE-2026-109597)
| Summary: | CVE-2026-109597 hugo: Hugo: Stored cross-site scripting via crafted heading identifiers | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | OSIDB Bzimport <bzimport> |
| Component: | vulnerability | Assignee: | Product Security DevOps Team <prodsec-dev> |
| Status: | NEW --- | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | unspecified | CC: | anjoseph, eglynn, jjoyce, jprabhak, jpretori, jschluet, lchilton, lhh, mburns, mgarciac, rhel-process-autobot, sfeifer, watson-tool-maintainers, wtam |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | --- | |
| Doc Text: |
A flaw was found in Hugo. An attacker with permissions to author Markdown content can exploit this stored cross-site scripting (XSS) vulnerability by supplying crafted heading identifiers. When Hugo generates a table of contents or heading fragments, the unescaped attributes allow arbitrary HTML and event handlers to be injected into rendered web pages. This issue may allow malicious scripts to run in the context of a visiting user's browser session.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | Type: | --- | |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 2555678, 2555679 | ||
| Bug Blocks: | |||
|
Description
OSIDB Bzimport
2026-10-12 22:55:35 UTC
|