CVE-2026-58402

Hugo is a static site generator. From 0.60.0 until 0.163.3, Hugo's default code-block renderer wrote the Markdown code-fence language or info-string into the code class="language-…" data-lang="…" wrapper without HTML escaping. A fence info-string containing a quote and a script payload breaks out of the attribute and injects a live script element. This issue is fixed in 0.163.3.

CVSS v3 5.4 MEDIUM

5.4^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.3 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://github.com/gohugoio/hugo/commit/ce1a7e0bce3713af40496ded3c2c0ceeed49231d	Patch
https://github.com/gohugoio/hugo/pull/15051	Issue Tracking
https://github.com/gohugoio/hugo/releases/tag/v0.163.3	Release Notes
https://github.com/gohugoio/hugo/security/advisories/GHSA-q76j-gcg9-vxc6	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:gohugo:hugo:*:*:*:*:*:*:*:*

History

25 Oct 2026, 20:10

Type	Values Removed	Values Added
Summary		(es) Hugo es un generador de sitios estáticos. Desde la versión 0.60.0 hasta la 0.163.3, el renderizador de bloques de código predeterminado de Hugo escribía el lenguaje de la valla de código Markdown o la cadena de información en el contenedor code class=“language-...” data-lang=“...” sin escape HTML. Una cadena de información de valla que contiene una comilla y una carga útil de script escapa del atributo e inyecta un elemento de script activo. Este problema se solucionó en la versión 0.163.3.

Information

Published : 2026-07-06 20:16

Updated : 2026-10-25 20:10

NVD link : CVE-2026-58402

Mitre link : CVE-2026-58402

CVE.ORG link : CVE-2026-58402

JSON object : View

Products Affected

gohugo

hugo

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2026-58402", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-58402", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-06T20:52:58.622823Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.3}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.1, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "LOW", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "gohugoio", "product": "hugo", "versions": [{"status": "affected", "version": ">= 0.60.0, < 0.163.3"}]}]}], "published": "2026-07-06T20:16:38.040", "references": [{"url": "https://github.com/gohugoio/hugo/commit/ce1a7e0bce3713af40496ded3c2c0ceeed49231d", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/gohugoio/hugo/pull/15051", "tags": ["Issue Tracking"], "source": "security-advisories@github.com"}, {"url": "https://github.com/gohugoio/hugo/releases/tag/v0.163.3", "tags": ["Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/gohugoio/hugo/security/advisories/GHSA-q76j-gcg9-vxc6", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "Hugo is a static site generator. From 0.60.0 until 0.163.3, Hugo's default code-block renderer wrote the Markdown code-fence language or info-string into the code class=\"language-\u2026\" data-lang=\"\u2026\" wrapper without HTML escaping. A fence info-string containing a quote and a script payload breaks out of the attribute and injects a live script element. This issue is fixed in 0.163.3."}, {"lang": "es", "value": "Hugo es un generador de sitios est\u00e1ticos. Desde la versi\u00f3n 0.60.0 hasta la 0.163.3, el renderizador de bloques de c\u00f3digo predeterminado de Hugo escrib\u00eda el lenguaje de la valla de c\u00f3digo Markdown o la cadena de informaci\u00f3n en el contenedor code class=\u201clanguage-...\u201d data-lang=\u201c...\u201d sin escape HTML. Una cadena de informaci\u00f3n de valla que contiene una comilla y una carga \u00fatil de script escapa del atributo e inyecta un elemento de script activo. Este problema se solucion\u00f3 en la versi\u00f3n 0.163.3."}], "lastModified": "2026-10-25T20:10:00.147", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:gohugo:hugo:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7DFF8755-C251-4C10-BAB6-96F8C8014132", "versionEndExcluding": "0.163.3", "versionStartIncluding": "0.60.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}