{"id":"CVE-2026-58402","aliases":["GHSA-q76j-gcg9-vxc6"],"title":"Hugo: XSS via unescaped code-fence language in default code block renderer","summary":"Hugo: XSS via unescaped code-fence language in default code block renderer","severity":"medium","vendor":"gohugoio","product":"github.com/gohugoio/hugo","ecosystem":"go","affected":["github.com/gohugoio/hugo >= 0.60.0, < 0.163.3"],"patched":["github.com/gohugoio/hugo 0.163.3"],"published":"2026-06-19","updated":"2026-07-08","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-q76j-gcg9-vxc6","references":[{"url":"https://github.com/gohugoio/hugo/security/advisories/GHSA-q76j-gcg9-vxc6"},{"url":"https://github.com/gohugoio/hugo"}],"tags":["osv","go"],"epss":0.003,"epssPercentile":0.22936,"ingestedAt":"2026-07-09T18:56:36.690Z","slug":"CVE-2026-58402","body":"## Overview\n\nHugo's default code-block renderer wrote the Markdown code-fence language / info-string into the `<code class=\"language-…\" data-lang=\"…\">` wrapper without HTML escaping. A fence info-string containing a quote and a `<script>` payload breaks out of the attribute and injects a live script element.\n\nThis is not an issue if you fully trust every file under /content and every content adapter you load.\n\n## Affected packages\n\n- `github.com/gohugoio/hugo >= 0.60.0, < 0.163.3`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `github.com/gohugoio/hugo 0.163.3`","depth":"sunlit","depthScore":28,"depthScoreParts":{"impact":27.5,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}