CVE-2026-10618
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk11th percentile - higher than 11% of all known CVEs
Summary
Hugo's default fenced-code-block renderer writes attribute values taken from the code-fence info string into the rendered HTML without escaping them. New code in markup/internal/attributes/attributes.go converts every attribute value from a byte slice to a string, dropping escaping, and RenderAttributes escapes only values that are still byte slices, so its escaping branch is never reached. A quote inside an attribute value can terminate the attribute and allow a further attribute, including an event handler, to be placed on the wrapper element, causing script execution for every visitor who loads the page.
Risk Assessment
Script execution in the visitor's browser may lead to data theft, session hijacking, or malware distribution.
Recommendation
Upgrade Hugo to a version that includes the fix. Temporarily disable default fenced-code-block rendering or use a custom render hook with proper escaping.
Other vulnerabilities in Hugo
See all- CVE-2026-89258Medium
Hugo is a static site generator. In versions after v0.123.0 and before v0.165.0, symlinks in parent directories were not dropped during direct resource lookups, allowing path confinement to be bypassed. An attacker who can place a symlink inside a mounted directory can cause functions such as resources.Get and os.ReadFile to follow that symlink and read files outside the intended project boundaries, disclosing their contents in the built site.
- CVE-2026-89259Critical
Hugo from v0.161.0 executes Node tools under Node's permission model, but TailwindCSS — included in the default security.exec.allow list — requires a highly permissive configuration (--allow-addons, --allow-child-process, --allow-worker). As a result, the restrictions intended by the fix for GHSA-x597-9fr4-5857 could still be bypassed, allowing a Node tool invoked during a build to read and write files outside the project's working directory. Affected versions are those after v0.43; the issue was fixed in v0.165.0 by removing tailwindcss from the default security.exec.allow list. Users who do not use TailwindCSS, or who only build trusted sites, are not affected. As a workaround, users can define a restrictive security.exec.allow list in hugo.toml.
- CVE-2026-109597Medium
Hugo from v0.60.0 before v0.167.0 contains a stored cross-site scripting vulnerability that allows Markdown content authors to inject HTML by supplying crafted explicit heading IDs. Attackers can break out of the unescaped href attribute in .TableOfContents or .Fragments.ToHTML output to inject elements with event handlers into rendered pages.
- CVE-2026-109596Medium
Hugo from v0.162.0 before v0.167.0 contains an improper link resolution vulnerability that lets malicious themes or modules expose files outside their root via nested-mount ancestor directories. Attackers controlling a theme can place a symlink or NTFS junction at a virtual ancestor directory, causing resources.Match to list and publish local files during builds.
- CVE-2026-109595Medium
Hugo from v0.84.0 before v0.167.0 contains a path traversal vulnerability that allows malicious themes or modules to read files outside the project root via ESBuild's fallback resolver in js.Build, js.Batch, and css.Build. Attackers can ship relative imports or symlinks pointing outside the project to bundle any file readable by the build user into published JavaScript or CSS output.
- CVE-2026-109574Medium
Hugo before v0.167.0 contains a path traversal vulnerability in css.Sass that allows malicious themes or modules to read files outside the project root through the Sass compiler's import fallback. Attackers can ship stylesheets with relative, absolute, or symlinked @import or @use targets to compile readable files into the published site CSS.
- CVE-2026-100694Medium
Hugo, a static site generator, in versions from v0.56.0 through v0.165.x renders content files mapped to the text/org media type without escaping raw HTML. Org export blocks and @@html:...@@ snippets pass HTML through unescaped, resulting in cross-site scripting (XSS) in the generated site. Only pages whose source file or content-adapter output declares the text/org media type are affected; version v0.166.0 fixes the issue by introducing a security.allowContent allowlist that denies text/org by default.
- CVE-2026-100693High
Hugo versions from v0.162.0 before v0.166.0 contain a case-sensitive validation flaw in the security.http.urls IP-literal deny rule that allows attackers to bypass restrictions. Attackers can use mixed-case URL schemes in resources.GetRemote calls to fetch from restricted IP addresses like localhost.
- CVE-2026-100692High
Hugo, a static site generator, in versions after v0.123.0 and before v0.166.0, has a flaw in its symlink confinement checks. A theme or module in themes/ (or a vendored module) can contain a symlink at a mount root, allowing files behind such a symlink to be read during a site build and published to public/, bypassing the rule that theme and module mount sources must be local paths.
- CVE-2026-100691Medium
Hugo versions 0.75.0 through 0.165.x contain a stored cross-site scripting vulnerability: the syntax highlighter does not escape the lineAnchors option before passing it to Chroma, which writes the value verbatim into the id and href attributes of the generated line-number markup. A crafted lineAnchors value supplied as a Markdown code fence attribute (or passed to the highlight template function) results in unescaped HTML in the rendered page, allowing arbitrary JavaScript to execute in the browsers of visitors. Fixed in 0.166.0, where the lineAnchors value is HTML-escaped before being passed to Chroma.
Original NVD description (English source)
Hugo's default fenced-code-block renderer writes attribute values taken from the code-fence info string into the rendered HTML without escaping them. New in markup/internal/attributes/attributes.go converts every attribute value from a byte slice to a string as it is stored, deliberately dropping the escaping that used to happen there, and RenderAttributes in the same file escapes only values that are still byte slices, so its escaping branch is never reached and every value is written verbatim. The function's documentation states that it performs HTML escaping of string attributes, which it does not. A quote inside an attribute value in the info string therefore terminates the attribute and allows a further attribute, including an event handler, to be placed on the wrapper element, and the script runs for every visitor who loads the page. This path is reached under the default configuration, with code fences enabled and without goldmark's unsafe setting or any custom render hook. Attribute names beginning with on are filtered when the attributes are parsed, so injection is achieved through the value rather than the name.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS