CVE-2026-10618: Hugo Fenced Code Block XSS Vulnerability

CVE-2026-10618 Overview

CVE-2026-10618 is a stored cross-site scripting (XSS) vulnerability in Hugo's default fenced-code-block renderer. The renderer writes attribute values taken from the code-fence info string into rendered HTML without escaping them. An attacker who can author Markdown content can inject arbitrary HTML attributes, including event handlers, onto the wrapper element. The injected script executes in the browser of every visitor who loads the affected page. The vulnerability is reachable under Hugo's default configuration with code fences enabled, without goldmark's unsafe setting, and without any custom render hook.

Critical Impact
Attacker-controlled Markdown can execute arbitrary JavaScript in the context of the Hugo-generated site, enabling session theft, credential harvesting, and further client-side attacks.

Affected Products

Hugo static site generator (default fenced-code-block renderer)
Sites built with goldmark markup using code-fence attribute values
Multi-author Hugo deployments where untrusted Markdown is rendered

Discovery Timeline

2026-08-24 - CVE-2026-10618 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-10618

Vulnerability Analysis

The flaw resides in markup/internal/attributes/attributes.go. The New function converts every attribute value from a byte slice to a string as it is stored, deliberately dropping the escaping that previously occurred at that stage. The RenderAttributes function in the same file only escapes values that remain byte slices. Because every value has already been converted to a string, the escaping branch is never reached and each value is written verbatim into the output HTML. The function's own documentation claims it performs HTML escaping of string attributes, which does not match its actual behavior. This is a classic improper output encoding issue tracked under [CWE-79].

Root Cause

The root cause is a mismatch between documented and implemented behavior in Hugo's attribute renderer. Storing values as strings bypasses the escaping code path that only triggers on byte slices. Attribute-name filtering blocks names beginning with on, but the filter does not cover injection through attribute values. A quote character inside a value terminates the current attribute and lets an attacker append additional attributes, including event handlers such as onerror or onclick, to the wrapper element.

Attack Vector

An attacker with the ability to submit Markdown content places a crafted fenced code block into a page. The info string of the fence contains an attribute value with an embedded quote followed by an event handler and JavaScript payload. When Hugo builds the site, the payload is written unescaped into the wrapper element. Every visitor who loads the page executes the injected script under the site's origin. Exploitation requires low privileges (content authorship) and user interaction (visiting the page). Refer to the VulnCheck Hugo XSS Advisory for the technical write-up.

Detection Methods for CVE-2026-10618

Indicators of Compromise

Fenced code blocks in Markdown source whose info strings contain unescaped quote characters followed by identifier-like tokens.
Rendered HTML containing event-handler attributes such as onerror, onload, or onmouseover on <div> or <code> wrapper elements generated by Hugo.
Unexpected outbound requests from site visitors' browsers to attacker-controlled domains after loading pages with user-contributed code samples.

Detection Strategies

Grep the site's content directory for fenced code blocks whose info strings contain " characters, then review the corresponding rendered HTML.
Diff generated HTML output against a known-good build to surface unexpected attributes on code-block wrappers.
Scan build artifacts with a static HTML linter or DOM-based XSS scanner to flag inline event handlers.

Monitoring Recommendations

Log and review all Markdown submissions from untrusted authors before publishing.
Deploy a strict Content Security Policy (CSP) that blocks inline event handlers and inline scripts, and alert on CSP violation reports.
Monitor build pipelines for Hugo version drift and warn when builds run on versions listed in the advisory.

How to Mitigate CVE-2026-10618

Immediate Actions Required

Upgrade Hugo to a patched release once available from the Hugo project.
Audit all site content for fenced code blocks whose info strings contain quote characters or event-handler-like tokens.
Restrict Markdown authorship to trusted contributors until the site is rebuilt on a patched Hugo version.

Patch Information

Refer to the Hugo repository releases and the VulnCheck Hugo XSS Advisory for fixed versions. The vulnerable code paths are in markup/internal/attributes/attributes.go, markup/goldmark/codeblocks/render.go, and markup/highlight/highlight.go. Rebuild and redeploy the site after upgrading.

Workarounds

Replace the default fenced-code-block renderer with a custom render hook that HTML-escapes every attribute value before emission.
Enforce a strict Content Security Policy that disallows inline event handlers and inline JavaScript on the published site.
Sanitize Markdown submissions in a pre-build step by rejecting fenced code blocks whose info strings contain quote characters.

bash

# Configuration example
# Enforce CSP via server response headers to block inline handlers
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self'; base-uri 'self'; object-src 'none'";