Is CVE-2026-10618 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-10618 being exploited in the wild.

How severe is CVE-2026-10618?

Medium severity, with a CVSS score of 5.4, published 24 August 2026.

Which products and versions are affected?

Hugo v0.165.0 and likely earlier versions.

Is there a fix for CVE-2026-10618?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-10618 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-10618?

Check whether you run Hugo at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-10618: Hugo fenced code block attribute injection

CVE-2026-10618 · Severity: medium · CVSS 5.4 · Published 2026-08-24

Hugo is a static site generator used to build websites. The default code block renderer fails to properly escape HTML attributes, allowing an attacker to inject malicious event handlers (like onclick) through code fence syntax. When a visitor loads the page containing the injected code, the malicious script executes in their browser.

Technologies: Hugo. Vendors: Hugo.

Quick answers

Is CVE-2026-10618 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-10618 being exploited in the wild.
How severe is CVE-2026-10618?: Medium severity, with a CVSS score of 5.4, published 24 August 2026.
Which products and versions are affected?: Hugo v0.165.0 and likely earlier versions.
Is there a fix for CVE-2026-10618?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-10618 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-10618?: Check whether you run Hugo at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an HTML attribute injection in Hugo's fenced code block renderer (goldmark extension). The root cause is in markup/internal/attributes/attributes.go, where attribute values are converted from byte slices to strings without proper HTML escaping. The RenderAttributes function was intended to escape string attributes but the escaping branch is never reached, causing all values to be written verbatim into HTML. An attacker can inject quotes within an attribute value in the code fence info string to terminate the attribute and inject additional attributes, including event handlers (onload, onerror, etc.). The attack is reachable under default configuration with code fences enabled and no special security settings. Attribute names beginning with "on" are filtered during parsing, but injection is achieved through crafted values instead.

Affected products

Hugo Hugo v0.165.0 and likely earlier versions

Timeline

2026-08-24: disclosed
other: CVE-2026-10618 assigned

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.