Hugo XSS in default code block renderer

Executive brief

Hugo is a popular tool used to build websites from Markdown files. A security flaw in how it handles code blocks allows a malicious contributor to inject harmful scripts into the generated website. If an attacker can submit content to your site, they could potentially execute code in the browsers of your site's visitors, leading to data theft or unauthorized actions.

Technical details

A Cross-Site Scripting (XSS) vulnerability exists in Hugo's default code-block renderer. The renderer writes the Markdown code-fence info-string directly into the HTML 'code' tag's class and data-lang attributes without proper HTML escaping. An attacker with the ability to provide Markdown content can use a specially crafted info-string containing quotes and script tags to break out of the HTML attribute and inject arbitrary JavaScript. This issue is mitigated if the content source is fully trusted. The vulnerability is addressed in version 0.163.3.

Affected products

• gohugoio Hugo >= 0.60.0, < 0.163.3

Timeline

• 2026-06-18: disclosed
• 2026-06-19: advisory
• 0.163.3: patched

References

• https://api.github.com/users/k0ngj1
• https://github.com/k0ngj1
• https://api.github.com/users/k0ngj1/gists%7B/gist_id%7D
• https://api.github.com/users/k0ngj1/repos
• https://avatars.githubusercontent.com/u/292788322?v=4
• https://api.github.com/users/k0ngj1/events%7B/privacy%7D