CVE-2026-10618

Hugo's default fenced-code-block renderer writes attribute values taken from the code-fence info string into the rendered HTML without escaping them. New in markup/internal/attributes/attributes.go converts every attribute value from a byte slice to a string as it is stored, deliberately dropping the escaping that used to happen there, and RenderAttributes in the same file escapes only values that are still byte slices, so its escaping branch is never reached and every value is written verbatim. The function's documentation states that it performs HTML escaping of string attributes, which it does not. A quote inside an attribute value in the info string therefore terminates the attribute and allows a further attribute, including an event handler, to be placed on the wrapper element, and the script runs for every visitor who loads the page. This path is reached under the default configuration, with code fences enabled and without goldmark's unsafe setting or any custom render hook. Attribute names beginning with on are filtered when the attributes are parsed, so injection is achieved through the value rather than the name.

• CWE-79

• https://github.com/gohugoio/hugo
• https://github.com/gohugoio/hugo/blob/v0.165.0/markup/goldmark/codeblocks/render.go
• https://github.com/gohugoio/hugo/blob/v0.165.0/markup/highlight/highlight.go
• https://github.com/gohugoio/hugo/blob/v0.165.0/markup/internal/attributes/attributes.go
• https://www.vulncheck.com/advisories/hugo-through-stored-cross-site-scripting-via-unescaped-code-fence-attribute-values

Published

Aug 24, 2026

Last Modified

Sep 24, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-10609A missing authorization flaw was found in the OpenShift Clus…6.8
• CVE-2026-1061A vulnerability was detected in xiweicheng TMS up to 2.28.0.…9.8
• CVE-2026-10610Local privilege escalation potentially allowed an attacker t…8.5
• CVE-2026-10611An authentication bypass vulnerability exists in MISP when L…10
• CVE-2026-10616A weakness has been identified in nextlevelbuilder GoClaw up…4.3
• CVE-2026-10617A security vulnerability has been detected in nextlevelbuild…7.3
• CVE-2026-10619A vulnerability was detected in sayan365 student-management-…7.3
• CVE-2026-1062A flaw has been found in xiweicheng TMS up to 2.28.0. This a…9.8
• CVE-2026-10620A flaw has been found in code-projects Student Admission Sys…7.3
• CVE-2026-10621Path traversal in restore handler in Collibra Agent, allows …7.5
• CVE-2026-10622Improper Authentication in REST API in Collibra Agent, allow…8.2
• CVE-2026-10623The PressPrimer Quiz – AI Quiz Maker, Exam Builder & LMS Ass…4.3