Hugo default code block renderer XSS via unescaped code-fence language

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-58402 · Microsoft / collected KEV context

EUVD-2026-41904

GHSA-q76j-gcg9-vxc6

GO-2026-5569

cve-program · CVE-2026-58402

• https://github.com/gohugoio/hugo/security/advisories/GHSA-q76j-gcg9-vxc6
• https://github.com/gohugoio/hugo/pull/15051
• https://github.com/gohugoio/hugo/commit/ce1a7e0bce3713af40496ded3c2c0ceeed49231d
• https://github.com/gohugoio/hugo/releases/tag/v0.163.3

euvd · EUVD-2026-41904

• https://github.com/gohugoio/hugo/security/advisories/GHSA-q76j-gcg9-vxc6
• https://github.com/gohugoio/hugo/pull/15051
• https://github.com/gohugoio/hugo/commit/ce1a7e0bce3713af40496ded3c2c0ceeed49231d
• https://github.com/gohugoio/hugo/releases/tag/v0.163.3

nvd · CVE-2026-58402

• https://github.com/gohugoio/hugo/commit/ce1a7e0bce3713af40496ded3c2c0ceeed49231d
• https://github.com/gohugoio/hugo/pull/15051
• https://github.com/gohugoio/hugo/releases/tag/v0.163.3
• https://github.com/gohugoio/hugo/security/advisories/GHSA-q76j-gcg9-vxc6

osv · GHSA-q76j-gcg9-vxc6

• https://github.com/gohugoio/hugo/security/advisories/GHSA-q76j-gcg9-vxc6
• https://github.com/gohugoio/hugo

osv · GO-2026-5569

• https://github.com/gohugoio/hugo/security/advisories/GHSA-q76j-gcg9-vxc6
• https://github.com/gohugoio/hugo/commit/ce1a7e0bce3713af40496ded3c2c0ceeed49231d

No related operational record is retained in the current change model.