GitHub Advisoryadvisory · Go

GHSA-q76j-gcg9-vxc6 Hugo: XSS via unescaped code-fence language in default code block renderer

MEDIUM Published 2026-06-19 Modified 2026-06-19 Official page ↗
Ecosystem
Go
Packages
github.com/gohugoio/hugo
Severity
Moderate
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
Weaknesses
CWE-79
Reviewed
2026-06-19

Affected packages

• Go github.com/gohugoio/hugo: >= 0.60.0, < 0.163.3 → fixed in 0.163.3

Description

Hugo's default code-block renderer wrote the Markdown code-fence language / info-string into the `` wrapper without HTML escaping. A fence info-string containing a quote and a `` payload breaks out of the attribute and injects a live script element. This is not an issue if you fully trust every file under /content and every content adapter you load.

Related

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References