Executive brief
Hugo is a static site generator used to build websites. The default code block renderer fails to properly escape HTML attributes, allowing an attacker to inject malicious event handlers (like onclick) through code fence syntax. When a visitor loads the page containing the injected code, the malicious script executes in their browser.
Technical details
The vulnerability is an HTML attribute injection in Hugo's fenced code block renderer (goldmark extension). The root cause is in markup/internal/attributes/attributes.go, where attribute values are converted from byte slices to strings without proper HTML escaping. The RenderAttributes function was intended to escape string attributes but the escaping branch is never reached, causing all values to be written verbatim into HTML. An attacker can inject quotes within an attribute value in the code fence info string to terminate the attribute and inject additional attributes, including event handlers (onload, onerror, etc.). The attack is reachable under default configuration with code fences enabled and no special security settings. Attribute names beginning with "on" are filtered during parsing, but injection is achieved through crafted values instead.
Affected products
- Hugo Hugo v0.165.0 and likely earlier versions
Timeline
- 2026-08-24: disclosed
- other: CVE-2026-10618 assigned