Hugo Markdown Renderer Link Escaping Vulnerability

A vulnerability exists in Hugo, a static site generator, in versions 0.60.0 prior to 0.159.2. The issue arises because links and image links are not properly escaped in the default markdown to HTML renderer. This vulnerability affects users who trust their Markdown content or have custom render hooks for links and images.

Impact

The vulnerability can lead to improper handling of links and images, potentially allowing for injection attacks or other exploitation methods that take advantage of the escaping issue.

Remediation

Users can upgrade to Hugo version 0.159.2 or later to address this vulnerability. Alternatively, custom render hooks for links and images can be created in the Hugo theme or project.