CVE-2026-58402: Hugo default code block renderer XSS via unescaped code-fence language
Hugo is a static site generator. From 0.60.0 until 0.163.3, Hugo's default code-block renderer wrote the Markdown code-fence language or info-string into the code class="language-…" data-lang="…" wrapper without HTML escaping. A fence info-string containing a quote and a script payload breaks out of the attribute and injects a live script element. This issue is fixed in 0.163.3.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 0.163.3
Event History
Frequently Asked Questions
What is the severity of CVE-2026-58402?
The severity of CVE-2026-58402 is classified as medium with a score of 5.1.
How do I fix CVE-2026-58402?
To fix CVE-2026-58402, upgrade Hugo to version 0.163.4 or later.
What does CVE-2026-58402 exploit?
CVE-2026-58402 exploits a cross-site scripting (XSS) vulnerability in Hugo's default code block renderer.
Which versions of Hugo are affected by CVE-2026-58402?
CVE-2026-58402 affects Hugo versions from 0.60.0 to 0.163.3.
What type of vulnerability is CVE-2026-58402?
CVE-2026-58402 is classified as an XSS vulnerability.