---
id: GHSA-q76j-gcg9-vxc6
title: 'Hugo: XSS via unescaped code-fence language in default code block renderer'
summary: 'Hugo: XSS via unescaped code-fence language in default code block renderer'
severity: medium
cwe:
  - CWE-79
vendor: gohugoio
product: github.com/gohugoio/hugo
affected:
  - 'github.com/gohugoio/hugo >= 0.60.0, < 0.163.3'
patched:
  - github.com/gohugoio/hugo 0.163.3
published: '2026-06-19'
updated: '2026-06-19'
source: GHSA
sourceUrl: 'https://github.com/advisories/GHSA-q76j-gcg9-vxc6'
references:
  - url: 'https://github.com/gohugoio/hugo/security/advisories/GHSA-q76j-gcg9-vxc6'
  - url: 'https://github.com/advisories/GHSA-q76j-gcg9-vxc6'
tags:
  - ghsa
  - go
ingestedAt: '2026-06-22T15:52:21.085Z'
ecosystem: go
---

## Overview

Hugo's default code-block renderer wrote the Markdown code-fence language / info-string into the `<code class="language-…" data-lang="…">` wrapper without HTML escaping. A fence info-string containing a quote and a `<script>` payload breaks out of the attribute and injects a live script element.

This is not an issue if you fully trust every file under /content and every content adapter you load.

## Affected packages

- `github.com/gohugoio/hugo >= 0.60.0, < 0.163.3`

## Remediation

Upgrade to a patched release:

- `github.com/gohugoio/hugo 0.163.3`