CVE-2026-10618

Name of the Vulnerable Software and Affected Versions Hugo versions 0.93.0 through 0.165.0

Description The default fenced-code-block renderer fails to escape attribute values derived from the code-fence info string when writing them to the rendered HTML. This occurs because the New function in markup/internal/attributes/attributes.go converts attribute values from byte slices to strings, bypassing the escaping process. Subsequently, the RenderAttributes() function only escapes values that remain as byte slices, meaning string values are written verbatim. An attacker can use a quote within an attribute value to terminate the attribute and inject additional attributes, such as event handlers, into the wrapper element, leading to stored Cross-Site Scripting (XSS). This issue is present in the default configuration when code fences are enabled, regardless of the goldmark unsafe setting or custom render hooks. While attribute names starting with on are filtered during parsing, injection is still possible via the attribute value.

Recommendations Update Hugo to a version later than 0.165.0.