CVE-2026-58402Medium▾ SunlitHugo: XSS via unescaped code-fence language in default code block renderer
▾ Sunlit zone — Low / medium · no exploitation signal
impact 27.5 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 9.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
Last analysed / modified upstream
0.2%
0.2% → 0.3%
Hugo's default code-block renderer wrote the Markdown code-fence language / info-string into the <code class="language-…" data-lang="…"> wrapper without HTML escaping. A fence info-string containing a quote and a <script> payload breaks out of the attribute and injects a live script element.
This is not an issue if you fully trust every file under /content and every content adapter you load.
github.com/gohugoio/hugo >= 0.60.0, < 0.163.3Upgrade to a patched release:
github.com/gohugoio/hugo 0.163.3Connected by shared product, vendor, weakness, or advisory.
CVE-2026-44301MediumHugo's Node tool execution allows file system access outside the project directory
CVE-2026-58404HighHugo: security.http.urls deny rules bypassed by alternate IPv4 encodings (SSRF)
CVE-2026-35166MediumHugo: Certain markdown links are not properly escaped
CVE-2026-58403MediumHugo: Symlink confinement bypass in os.ReadFile
GHSA-q76j-gcg9-vxc6MediumHugo: XSS via unescaped code-fence language in default code block renderer
CVE-2020-26284High· 7.7Hugo can execute a binary from the current directory on Windows