GHSA-q76j-gcg9-vxc6Medium▾ SunlitHugo: XSS via unescaped code-fence language in default code block renderer
▾ Sunlit zone — Low / medium · no exploitation signal
impact 27.5 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Hugo's default code-block renderer wrote the Markdown code-fence language / info-string into the <code class="language-…" data-lang="…"> wrapper without HTML escaping. A fence info-string containing a quote and a <script> payload breaks out of the attribute and injects a live script element.
This is not an issue if you fully trust every file under /content and every content adapter you load.
github.com/gohugoio/hugo >= 0.60.0, < 0.163.3Upgrade to a patched release:
github.com/gohugoio/hugo 0.163.3Connected by shared product, vendor, weakness, or advisory.
CVE-2026-58402MediumHugo: XSS via unescaped code-fence language in default code block renderer
CVE-2026-50133MediumHugo: XSS via text/html content files
CVE-2026-44301MediumHugo's Node tool execution allows file system access outside the project directory
CVE-2026-58404HighHugo: security.http.urls deny rules bypassed by alternate IPv4 encodings (SSRF)
CVE-2026-35166MediumHugo: Certain markdown links are not properly escaped
CVE-2026-58403MediumHugo: Symlink confinement bypass in os.ReadFile