{"id":"GHSA-q76j-gcg9-vxc6","title":"Hugo: XSS via unescaped code-fence language in default code block renderer","summary":"Hugo: XSS via unescaped code-fence language in default code block renderer","severity":"medium","cwe":["CWE-79"],"vendor":"gohugoio","product":"github.com/gohugoio/hugo","affected":["github.com/gohugoio/hugo >= 0.60.0, < 0.163.3"],"patched":["github.com/gohugoio/hugo 0.163.3"],"published":"2026-06-19","updated":"2026-06-19","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-q76j-gcg9-vxc6","references":[{"url":"https://github.com/gohugoio/hugo/security/advisories/GHSA-q76j-gcg9-vxc6"},{"url":"https://github.com/advisories/GHSA-q76j-gcg9-vxc6"}],"tags":["ghsa","go"],"ingestedAt":"2026-06-22T15:52:21.085Z","ecosystem":"go","slug":"GHSA-q76j-gcg9-vxc6","body":"## Overview\n\nHugo's default code-block renderer wrote the Markdown code-fence language / info-string into the `<code class=\"language-…\" data-lang=\"…\">` wrapper without HTML escaping. A fence info-string containing a quote and a `<script>` payload breaks out of the attribute and injects a live script element.\n\nThis is not an issue if you fully trust every file under /content and every content adapter you load.\n\n## Affected packages\n\n- `github.com/gohugoio/hugo >= 0.60.0, < 0.163.3`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `github.com/gohugoio/hugo 0.163.3`","depth":"sunlit","depthScore":28,"depthScoreParts":{"impact":27.5,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}