Skip to content

XSS via unescaped code-fence language in default code block renderer

Moderate
bep published GHSA-q76j-gcg9-vxc6 Jun 18, 2026

Package

gomod github.com/gohugoio/hugo (Go)

Affected versions

>= v0.60.0

Patched versions

v0.163.3

Description

Hugo's default code-block renderer wrote the Markdown code-fence language / info-string into the <code class="language-…" data-lang="…"> wrapper without HTML escaping. A fence info-string containing a quote and a <script> payload breaks out of the attribute and injects a live script element.

This is not an issue if you fully trust every file under /content and every content adapter you load.

Severity

Moderate

CVE ID

CVE-2026-58402

Weaknesses

No CWEs

Credits