Stored Cross-Site Scripting Vulnerability in Hugo by GoHugoIO

CVE-2026-10618

What is CVE-2026-10618?

A stored cross-site scripting vulnerability exists in Hugo's default fenced-code-block renderer. This security flaw allows unescaped attribute values taken from the code-fence info string to be directly written into rendered HTML, enabling an attacker to inject malicious scripts. Specifically, due to improper escaping during attribute handling, a quote inside an attribute value can terminate the attribute, facilitating the placement of unauthorized event handlers in the wrapper element. This issue can be exploited in the default configuration with code fences enabled, posing a significant risk to visitors interacting with the affected web pages.

References