CVE-2026-58402: Gohugo Hugo XSS Vulnerability

CVE-2026-58402 Overview

CVE-2026-58402 is a stored cross-site scripting (XSS) vulnerability in Hugo, an open-source static site generator written in Go. The flaw affects Hugo versions 0.60.0 through 0.163.2. Hugo's default code-block renderer wrote the Markdown code-fence language or info-string into the class="language-…" and data-lang="…" wrapper attributes without HTML escaping. A fence info-string containing a quote and script payload breaks out of the attribute and injects a live <script> element into the generated HTML page. The issue is fixed in Hugo 0.163.3 and tracked under [CWE-79]. The vulnerability is cataloged in GitHub Security Advisory GHSA-q76j-gcg9-vxc6.

Critical Impact
Malicious Markdown authors can inject arbitrary JavaScript into Hugo-generated pages, enabling stored XSS against site visitors and content editors.

Affected Products

Hugo 0.60.0 through 0.163.2 (default code-block renderer)
Hugo sites accepting Markdown from untrusted contributors
Downstream builds and pipelines using vulnerable Hugo versions

Discovery Timeline

2026-07-06 - CVE-2026-58402 published to NVD
2026-07-08 - Last updated in NVD database

Technical Details for CVE-2026-58402

Vulnerability Analysis

Hugo renders fenced code blocks by writing the language identifier directly into the surrounding HTML wrapper. The default renderer emits <code class="language-LANG" data-lang="LANG">, where LANG originates from the Markdown fence info-string supplied by the content author. Because Hugo did not apply HTML escaping to that value, an attacker can supply an info-string containing a double quote to close the attribute and inject arbitrary HTML, including a <script> element that executes in the browser context of the generated site.

The impact depends on where the malicious Markdown originates. Sites that accept community contributions, documentation pull requests, or user-generated content are directly exposed. Exploitation persists in the generated static HTML output until the site is rebuilt with the patched Hugo version.

Root Cause

The root cause is missing output encoding in the inlineCodeAttrs function and the WritePreStart function within markup/highlight/highlight.go. The language string was concatenated into HTML attribute values with fmt.Fprint without invoking gohtml.EscapeString. This violates the neutralization requirements described in [CWE-79] (Improper Neutralization of Input During Web Page Generation).

Attack Vector

An attacker authors a Markdown file containing a code fence whose info-string carries an attribute-breaking payload. When Hugo processes the Markdown, the payload escapes the class and data-lang attributes and injects executable script into the rendered page. Exploitation requires that a maintainer build the site with vulnerable Hugo and that a visitor load the resulting page.

// Patch: markup/highlight/highlight.go
 func inlineCodeAttrs(lang string) string {
+	lang = gohtml.EscapeString(lang)
 	return fmt.Sprintf(` class="code-inline language-%s"`, lang)
 }

 func WritePreStart(w io.Writer, language, styleAttr string) {
 	fmt.Fprintf(w, `<pre tabindex="0"%s>`, styleAttr)
 	fmt.Fprint(w, "<code")
 	if language != "" {
+		language = gohtml.EscapeString(language)
 		fmt.Fprint(w, ` class="language-`+language+`"`)
 		fmt.Fprint(w, ` data-lang="`+language+`"`)
 	}
// Source: https://github.com/gohugoio/hugo/commit/ce1a7e0bce3713af40496ded3c2c0ceeed49231d

The patch calls gohtml.EscapeString on the language identifier before writing it into both the inline and block code wrappers, neutralizing quote and angle-bracket characters.

Detection Methods for CVE-2026-58402

Indicators of Compromise

Generated HTML files containing <code class="language- values with unescaped quotes, angle brackets, or <script> fragments.
Markdown source files with fenced code blocks whose info-string contains ", >, or HTML tag syntax.
Unexpected outbound network requests from static pages that previously contained only code samples.

Detection Strategies

Grep repository content for Markdown fences matching the pattern ```[^\n]*["<>] to surface suspicious info-strings.
Scan built site output for class="language- values containing characters other than alphanumerics, hyphens, and underscores.
Query the Hugo version used in build pipelines and flag any hugo version output below 0.163.3.

Monitoring Recommendations

Add a Content Security Policy (CSP) with script-src restrictions to Hugo-generated sites and alert on CSP violation reports.
Monitor CI/CD logs for Hugo build steps and enforce a minimum version pin.
Review pull requests that modify Markdown fenced code blocks in projects that accept external contributions.

How to Mitigate CVE-2026-58402

Immediate Actions Required

Upgrade Hugo to version 0.163.3 or later across all build environments.
Rebuild and redeploy all sites previously generated with a vulnerable Hugo version.
Audit Markdown content submitted by external contributors since the deployment of Hugo 0.60.0.

Patch Information

The fix is committed in gohugoio/hugo commit ce1a7e0 and released in Hugo v0.163.3. See the GitHub Security Advisory GHSA-q76j-gcg9-vxc6 for the official disclosure and the pull request discussion for design context.

Workarounds

Replace the default code-block renderer with a custom render hook that sanitizes the language identifier before emitting attributes.
Restrict Markdown authorship to trusted contributors until the upgrade is complete.
Apply a strict Content Security Policy that disallows inline scripts on Hugo-generated pages.

bash

# Upgrade Hugo and verify the installed version
go install github.com/gohugoio/hugo@v0.163.3
hugo version

# Rebuild the site with the patched binary
hugo --gc --minify