{"id":"GHSA-q76j-gcg9-vxc6","revision":"1c5864a815824f65bc58ed9c37fa25e3","records":[{"revision":"1c5864a815824f65bc58ed9c37fa25e3","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GHSA-q76j-gcg9-vxc6","aliases":["CVE-2026-58402","GO-2026-5569"],"title":"Hugo: XSS via unescaped code-fence language in default code block renderer","description":"Hugo's default code-block renderer wrote the Markdown code-fence language / info-string into the `<code class=\"language-…\" data-lang=\"…\">` wrapper without HTML escaping. A fence info-string containing a quote and a `<script>` payload breaks out of the attribute and injects a live script element.\n\nThis is not an issue if you fully trust every file under /content and every content adapter you load.","state":0,"publishedAt":"2026-06-19T17:45:27+00:00","modifiedAt":"2026-07-24T19:11:31.045541+00:00","affected":[{"ecosystem":"Go","name":"github.com/gohugoio/hugo","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0.60.0"},{"kind":"fixed","version":"0.163.3"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V4","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"MODERATE"}],"references":["https://github.com/gohugoio/hugo/security/advisories/GHSA-q76j-gcg9-vxc6","https://github.com/gohugoio/hugo"],"sourceUrl":"https://github.com/advisories/GHSA-q76j-gcg9-vxc6","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-q76j-gcg9-vxc6","identifiers":["GHSA-q76j-gcg9-vxc6","CVE-2026-58402","GO-2026-5569"]},"retained":false,"historicalAffected":[]}],"coverage":[]}