{"schema":"threatline.record/2","record":{"id":"GHSA-wcpj-vcvm-j4pg","aliases":["GHSA-wcpj-vcvm-j4pg"],"summary":"Stored XSS via unescaped heading ID in Table of Contents HTML","details":"### Impact\r\n\r\nExplicit heading IDs in Markdown (e.g. `## Intro {id=\"...\"}`) were written unescaped into the `href` of the generated Table of Contents HTML. A content author who controls Markdown can break out of the attribute and inject arbitrary HTML, including elements with event handlers, into any page that renders `.TableOfContents` or `.Fragments.ToHTML`.\r\n\r\nThis affects sites that build untrusted or third-party Markdown content and render a table of contents. The heading element itself was already escaped; only the ToC output was affected.\r\n\r\n### Affected versions\r\n\r\nHugo v0.60.0 (Goldmark as the default Markdown renderer) up to and including v0.166.0.\r\n\r\n### Patches\r\n\r\nFixed in v0.167.0 by escaping heading IDs before they are written to the ToC HTML.\r\n\r\n### Workarounds\r\n\r\nDo not render `.TableOfContents` or `.Fragments.ToHTML` for untrusted content, or validate heading IDs in a content pipeline before building.\r\n\r\n### References\r\n\r\n- CWE-79: Improper Neutralization of Input During Web Page Generation\r\n","categories":["Unclassified"],"product":"github.com/gohugoio/hugo","vendor":"","ecosystem":null,"affected_ranges":[{"source":"GitHub Advisory Database","source_url":"https://github.com/gohugoio/hugo/security/advisories/GHSA-wcpj-vcvm-j4pg","source_modified_at":"2026-09-28T15:45:28Z","fetched_at":"2026-10-23T21:10:45.942435Z","package":{"ecosystem":"go","name":"github.com/gohugoio/hugo"},"range":">= v0.60.0"}],"fixed_versions":[],"cvss":null,"severity":"Medium","kev":{"listed":false},"epss":{"probability":null,"percentile":null,"score_date":null},"published_at":"2026-09-28T15:45:28Z","modified_at":"2026-09-28T15:45:28Z","provenance":[{"source":"GitHub Advisory Database","url":"https://github.com/gohugoio/hugo/security/advisories/GHSA-wcpj-vcvm-j4pg","fetched_at":"2026-10-23T21:10:45.942435Z","source_modified_at":"2026-09-28T15:45:28Z"}],"sources":["GitHub Advisory Database"],"references":[],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-09-28T15:45:28Z","content_hash":"cbf65a5c6a89959ceda2053b6d9f5ccac30d28a459639e88ed614e8a01a18aa0"}}