{"id":"EUVD-2026-41904","enisaUuid":"c3fb2fac-a62c-382a-b357-ebcacf0ce2f5","description":"Hugo is a static site generator. From 0.60.0 until 0.163.3, Hugo\u0027s default code-block renderer wrote the Markdown code-fence language or info-string into the code class\u003d\"language-…\" data-lang\u003d\"…\" wrapper without HTML escaping. A fence info-string containing a quote and a script payload breaks out of the attribute and injects a live script element. This issue is fixed in 0.163.3.","datePublished":"Jul 6, 2026, 7:19:58 PM","dateUpdated":"Jul 6, 2026, 8:54:38 PM","baseScore":5.1,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","references":"https://github.com/gohugoio/hugo/security/advisories/GHSA-q76j-gcg9-vxc6\nhttps://github.com/gohugoio/hugo/pull/15051\nhttps://github.com/gohugoio/hugo/commit/ce1a7e0bce3713af40496ded3c2c0ceeed49231d\nhttps://github.com/gohugoio/hugo/releases/tag/v0.163.3\n","aliases":"CVE-2026-58402\n","assigner":"GitHub_M","epss":0.3,"enisaIdProduct":[{"id":"b3412a52-a0bf-31f7-a605-be76f1d13a50","product":{"name":"hugo","vendor":{"name":"gohugoio"}},"product_version":"0.60.0, \u003c 0.163.3"}],"enisaIdVendor":[{"id":"8bd0113f-a000-312c-bb9f-241f13d9d1fa","vendor":{"name":"gohugoio"}}],"enisaIdVulnerability":[{"id":"160d20c6-bb72-3348-a083-69c94a021581","vulnerability":{"id":"CVE-2026-58402","description":"Hugo is a static site generator. From 0.60.0 until 0.163.3, Hugo\u0027s default code-block renderer wrote the Markdown code-fence language or info-string into the code class\u003d\"language-…\" data-lang\u003d\"…\" wrapper without HTML escaping. A fence info-string containing a quote and a script payload breaks out of the attribute and injects a live script element. This issue is fixed in 0.163.3.","datePublished":"Jul 6, 2026, 7:19:58 PM","dateUpdated":"Jul 6, 2026, 8:54:38 PM","status":"PUBLISHED","baseScore":5.1,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","references":"https://github.com/gohugoio/hugo/security/advisories/GHSA-q76j-gcg9-vxc6\nhttps://github.com/gohugoio/hugo/pull/15051\nhttps://github.com/gohugoio/hugo/commit/ce1a7e0bce3713af40496ded3c2c0ceeed49231d\nhttps://github.com/gohugoio/hugo/releases/tag/v0.163.3\n","enisa_id":"EUVD-2026-41904\n","assigner":"GitHub_M","epss":0.3,"dataProcessed":"Nov 7, 2026, 7:21:40 AM","vulnerabilityProduct":[{"id":"18df8aaa-482d-389a-a93f-04c38dfec1cb","product":{"name":"hugo","vendor":{"name":"gohugoio"}},"product_version":"0.60.0, \u003c 0.163.3"}],"vulnerabilityVendor":[{"id":"c900fcb2-f3ab-3d43-8db3-03ee582167d5","vendor":{"name":"gohugoio"}}]}}],"enisaIdAdvisory":[{"id":"6d5bc94c-7326-3a5b-ad11-e7dfc1d05f6c","advisory":{"id":"RHSA-2026:36862","description":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","summary":"An update for Red Hat Hardened Images RPMs is now available.","datePublished":"Jul 8, 2026, 8:16:29 PM","dateUpdated":"Sep 8, 2026, 12:06:46 AM","baseScore":0.0,"references":"https://access.redhat.com/errata/RHSA-2026:36862\nhttps://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_36862.json\n","aliases":"CVE-2026-50133\nCVE-2026-58402\nCVE-2026-58403\nCVE-2026-58404\n","source":{"id":9,"name":"csaf_redhat"},"advisoryProduct":[{"id":"49c3db57-a74d-31eb-9130-2db9e2e58362","product":{"name":"hugo-main@src","vendor":{"name":"Red Hat"}}},{"id":"9ec5bace-2d36-3dd2-9585-a6b6f9d6e72e","product":{"name":"Red Hat Hardened Images","vendor":{"name":"Red Hat"}}},{"id":"a13e8035-a773-3f92-a83d-87720fd9999c","product":{"name":"hugo-main@x86_64","vendor":{"name":"Red Hat"}}},{"id":"efdf1028-b694-3d4a-90c4-28adde3fb315","product":{"name":"hugo-main@aarch64","vendor":{"name":"Red Hat"}}}]}}]}