CVE-2026-58402
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
Hugo from version 0.60.0 to 0.163.3 by default rendered Markdown code blocks without proper HTML escaping in class and data-lang attributes. An info-string containing a quote and JavaScript payload could break out of the attribute and inject a live script element.
Risk Assessment
An attacker can inject malicious JavaScript into the generated page, leading to XSS (Cross-Site Scripting) attacks and potential user data theft.
Recommendation
Upgrade Hugo to version 0.163.3 or later immediately, which includes a fix preventing script injection.
Original NVD description (English source)
Hugo is a static site generator. From 0.60.0 until 0.163.3, Hugo's default code-block renderer wrote the Markdown code-fence language or info-string into the code class="language-…" data-lang="…" wrapper without HTML escaping. A fence info-string containing a quote and a script payload breaks out of the attribute and injects a live script element. This issue is fixed in 0.163.3.