{"id":"GO-2026-5569","revision":"b89f7c62bc3b4d2889e8104edc3fdca2","records":[{"revision":"b89f7c62bc3b4d2889e8104edc3fdca2","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GO-2026-5569","aliases":["CVE-2026-58402","GHSA-q76j-gcg9-vxc6"],"title":"Hugo: XSS via unescaped code-fence language in default code block renderer in github.com/gohugoio/hugo","description":"Hugo: XSS via unescaped code-fence language in default code block renderer in github.com/gohugoio/hugo","state":0,"publishedAt":"2026-07-24T18:35:55+00:00","modifiedAt":"2026-07-24T19:11:31.045541+00:00","affected":[{"ecosystem":"Go","name":"github.com/gohugoio/hugo","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0.60.0"},{"kind":"fixed","version":"0.163.3"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://github.com/gohugoio/hugo/security/advisories/GHSA-q76j-gcg9-vxc6","https://github.com/gohugoio/hugo/commit/ce1a7e0bce3713af40496ded3c2c0ceeed49231d"],"sourceUrl":"https://osv.dev/vulnerability/GO-2026-5569","license":"OSV · upstream source license applies","key":"osv:GO-2026-5569","identifiers":["GO-2026-5569","CVE-2026-58402","GHSA-q76j-gcg9-vxc6"]},"retained":false,"historicalAffected":[]}],"coverage":[]}