github.com/gohugoio/hugo: Stored XSS via unescaped heading ID in Table of Contents HTML

Impact

Explicit heading IDs in Markdown (e.g. ## Intro {id="..."}) were written unescaped into the href of the generated Table of Contents HTML. A content author who controls Markdown can break out of the attribute and inject arbitrary HTML, including elements with event handlers, into any page that renders .TableOfContents or .Fragments.ToHTML.

This affects sites that build untrusted or third-party Markdown content and render a table of contents. The heading element itself was already escaped; only the ToC output was affected.

Affected versions

Hugo v0.60.0 (Goldmark as the default Markdown renderer) up to and including v0.166.0.

Patches

Fixed in v0.167.0 by escaping heading IDs before they are written to the ToC HTML.

Workarounds

Do not render .TableOfContents or .Fragments.ToHTML for untrusted content, or validate heading IDs in a content pipeline before building.

References

• CWE-79: Improper Neutralization of Input During Web Page Generation