CVE-2026-10618
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
Hugo's default fenced-code-block renderer writes attribute values taken from the code-fence info string into the rendered HTML without escaping them. New code in markup/internal/attributes/attributes.go converts every attribute value from a byte slice to a string, dropping escaping, and RenderAttributes escapes only values that are still byte slices, so its escaping branch is never reached. A quote inside an attribute value can terminate the attribute and allow a further attribute, including an event handler, to be placed on the wrapper element, causing script execution for every visitor who loads the page.
Risk Assessment
Script execution in the visitor's browser may lead to data theft, session hijacking, or malware distribution.
Recommendation
Upgrade Hugo to a version that includes the fix. Temporarily disable default fenced-code-block rendering or use a custom render hook with proper escaping.
Other vulnerabilities in Hugo
See all- CVE-2026-10582High
Hugo does not verify the actual IP address the HTTP client connects to when fetching resources via resources.GetRemote. The security.http.urls allowlist only checks the URL text, not the real destination, allowing access to internal resources.
- CVE-2026-75926High
Hugo 0.162.0 added tailwindcss to the default AllowChildProcess list, causing the Node.js process for TailwindCSS to have child process permissions. Top-level code in tailwind.config.js can execute arbitrary commands, bypassing the Node.js permission model.
- CVE-2026-50135Medium
In Hugo from version 0.123.0 to 0.161.1, a regression made RootMappingFs.statRoot use Stat (follows symlinks) instead of Lstat, allowing a symlink planted in a local mount (e.g. a vendored themes/ theme) to read arbitrary files accessible to the Hugo user via resources.Get.
- CVE-2026-58404Medium
A vulnerability in Hugo from v0.162.0 to v0.163.0 allows bypassing the security policy that blocks requests to loopback, internal, and cloud-metadata IPv4 addresses. The policy only matched dotted-decimal notation, so alternative IPv4 encodings (integer, hex, octal) bypassed the block. When a template passes an untrusted URL to resources.GetRemote and the host uses the cgo system resolver, these encodings resolve to blocked addresses, enabling SSRF attacks to internal services and cloud-metadata endpoints in hosted or CI builds.
- CVE-2026-58403Medium
A vulnerability in Hugo (versions 0.123.0 through 0.163.0) allows bypassing virtual filesystem security. A bug in RootMappingFs.statRoot causes symbolic links inside mounted directories to point outside the mount tree, enabling reading arbitrary files accessible to the user running Hugo.
- CVE-2026-58402Medium
Hugo from version 0.60.0 to 0.163.3 by default rendered Markdown code blocks without proper HTML escaping in class and data-lang attributes. An info-string containing a quote and JavaScript payload could break out of the attribute and inject a live script element.
- CVE-2026-50134Medium
In Hugo from version 0.91.0 to 0.162.0, the resources.GetRemote function does not re-validate destination URLs after HTTP 3xx redirects, allowing bypass of the security.http.urls policy. An attacker can redirect the request to a forbidden host, and Hugo will fetch from it.
- CVE-2026-50133Medium
Hugo before version 0.162.0 accepts content files in various markup formats. Files mapped to the text/html media type (e.g., .html files under /content) are emitted verbatim into the rendered page, enabling stored XSS attacks.
Original NVD description (English source)
Hugo's default fenced-code-block renderer writes attribute values taken from the code-fence info string into the rendered HTML without escaping them. New in markup/internal/attributes/attributes.go converts every attribute value from a byte slice to a string as it is stored, deliberately dropping the escaping that used to happen there, and RenderAttributes in the same file escapes only values that are still byte slices, so its escaping branch is never reached and every value is written verbatim. The function's documentation states that it performs HTML escaping of string attributes, which it does not. A quote inside an attribute value in the info string therefore terminates the attribute and allows a further attribute, including an event handler, to be placed on the wrapper element, and the script runs for every visitor who loads the page. This path is reached under the default configuration, with code fences enabled and without goldmark's unsafe setting or any custom render hook. Attribute names beginning with on are filtered when the attributes are parsed, so injection is achieved through the value rather than the name.