CVE-2026-10618: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in gohugoio hugo

Hugo's default fenced-code-block renderer converts attribute values from byte slices to strings without escaping, contrary to the function documentation. The RenderAttributes function only escapes byte slice values, which are not used after conversion, resulting in attribute values being written verbatim into HTML. This allows an attacker to inject a quote character inside an attribute value, terminating the attribute early and enabling injection of additional attributes such as event handlers. Attribute names starting with 'on' are filtered, so the injection occurs through the attribute value. This vulnerability is reachable under default Hugo settings with code fences enabled and without unsafe goldmark settings or custom render hooks.

An attacker can inject malicious scripts into web pages generated by vulnerable Hugo versions, leading to cross-site scripting attacks. This can result in script execution in the context of users visiting the affected site, potentially compromising user data or session information. The CVSS 4.8 score reflects a medium severity with network attack vector, low privileges required, and user interaction needed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider disabling code fences or using custom render hooks that properly escape attribute values. Avoid enabling unsafe goldmark settings that might exacerbate the issue. Monitor official Hugo project channels for updates and apply patches promptly once released.