CVE-2026-58402: Hugo Code-Block XSS Vulnerability – Patch to 0.163.3

Technical summary

The vulnerability is a reflected cross-site scripting (XSS) weakness in Hugo's default code-block renderer. Specifically, the Markdown parser processes code fences and extracts the info-string (language identifier) without HTML entity encoding before injecting it into the class="language-…" and data-lang="…" attributes of the rendered <code> element. By crafting an info-string such as `python" onload="alert(1)`, an attacker can break out of the attribute context, close the tag, and inject arbitrary HTML and script elements. Because rendering occurs at build time and the output is static HTML, the injected script runs client-side in every visitor's browser. The CWE-79 classification confirms this is an improper neutralization of input during web page generation.

Business impact

For organizations using Hugo to build public-facing websites, documentation portals, or community-driven content sites, this vulnerability creates a pathway for website defacement, credential theft, and malware distribution. If an attacker gains write access to the content repository (via social engineering, insider threat, or a supply-chain compromise of a plugin), they can silently inject malicious code that affects all visitors. For projects with open contribution models—such as open-source documentation or wikis—the risk is heightened. Even a single merged pull request containing a malicious code fence can compromise user trust and expose visitor data. Remediation requires both patching and, critically, auditing existing content for suspicious code-block language identifiers.

Affected systems

Hugo versions 0.60.0 through 0.163.2 are affected. Any site generated with these versions that includes Markdown code blocks is potentially vulnerable if an attacker can control or influence the code-fence language identifier. Projects that accept user-contributed Markdown content, pull requests, or dynamic content injection are at highest risk. The vulnerability does not affect sites that only use hardcoded, author-controlled Markdown.

Exploitability

Exploitation requires two conditions: (1) the attacker must have direct or indirect write access to Markdown content, either by compromising a repository, submitting a pull request, or exploiting a content management layer; and (2) a visitor must view the generated HTML page in a web browser where JavaScript is enabled. The CVSS vector (AV:N/AC:L/PR:L/UI:R/S:C) reflects that network access and low complexity make the attack straightforward, but exploitation does require authentication or collaboration privileges (PR:L) and relies on user interaction (UI:R) to view the malicious page. This is not a wormable, unauthenticated attack, but it is trivially simple once access to content is achieved.

Remediation

Upgrade Hugo to version 0.163.3 or later immediately. This version includes HTML escaping in the code-block renderer. After upgrading, rebuild all affected sites to generate new HTML. For projects with open contributions or a history of pull requests, audit the Markdown source for any suspicious code-fence info-strings containing quotes, script tags, event handlers, or other unexpected payloads. Consider implementing a pre-commit or pre-merge hook to reject code blocks with dangerous patterns, and review access logs to identify any prior unauthorized content modifications.

Patch guidance

Update Hugo via your package manager (e.g., `brew upgrade hugo` on macOS, `apt-get install hugo` on Debian/Ubuntu, or direct download from the Hugo releases page) to 0.163.3 or any later stable release. Verify the version after installation using `hugo version`. Once upgraded, regenerate your site (typically `hugo`) and redeploy the static output. If you use Hugo modules or third-party themes, ensure those are also up to date, as they may have their own rendering logic. Verify against the official Hugo release notes to confirm the patch includes the code-block escaping fix.

Detection guidance

Search your Markdown source files for code-fence info-strings that contain quotes, backticks, or event handler keywords (e.g., `onerror=`, `onload=`, `onclick=`). Use regex patterns like `^\`\`\`[^`]*["'].*[=<>]` to identify suspicious fence headers. In your web server or CDN logs, look for unusual JavaScript errors or client-side exceptions that might indicate injected script attempts. If you host on a platform like GitHub Pages or Netlify, review the build logs to see if older Hugo versions were used for recent builds. Scanning the generated HTML files for unexpected <script> tags immediately after code blocks can also surface injections that occurred in prior builds.

Why prioritize this

Although the CVSS score is MEDIUM (5.4), this vulnerability warrants prompt attention because: (1) it affects a widely-used static site generator with a large ecosystem; (2) the attack surface is broad for any site accepting community contributions; (3) once injected, the malicious script reaches all visitors without further barriers; (4) the fix is straightforward and low-risk. Organizations should prioritize this after critical/high-severity vulns but ahead of lower-impact issues, especially if they operate collaborative content platforms.

Risk score, explained

The CVSS 3.1 score of 5.4 (MEDIUM) reflects: AV:N (network-accessible vulnerability), AC:L (low complexity; no special conditions needed beyond access to content), PR:L (requires some privileges such as contributor status), UI:R (requires a user to view the malicious page), S:C (the impact crosses trust boundaries—visitors' browsers are affected), C:L (low confidentiality impact; mostly affects the visitor, not the site itself), I:L (low integrity impact; XSS allows script execution but doesn't directly modify stored data), A:N (no availability impact). The score appropriately reflects that this is a contained but meaningful risk, not a critical infrastructure threat.

Frequently asked questions