Hugo's default fenced-code-block renderer converts attribute values from code-fence info strings into strings without escaping them, contrary to the function documentation. The RenderAttributes function only escapes byte slice values, but since values are stored as strings, escaping is never applied. This allows an attacker to inject a quote character inside an attribute value, terminating the attribute early and enabling injection of additional attributes such as event handlers on the wrapper element. The vulnerability is exploitable under default configuration with code fences enabled and without enabling goldmark's unsafe setting or custom render hooks. Attribute names starting with 'on' are filtered, so the injection vector is through attribute values rather than names.

An attacker can inject malicious script code into pages generated by Hugo, which executes in the browsers of visitors loading the affected pages. This cross-site scripting vulnerability can lead to client-side code execution, potentially resulting in session hijacking, defacement, or other malicious actions depending on the context of the site. The impact is limited to sites using the vulnerable Hugo versions with default code fence rendering enabled.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider disabling fenced-code-block rendering or using custom render hooks to sanitize attribute values. Avoid enabling goldmark's unsafe setting unless necessary and with caution. Monitor official Hugo channels for updates addressing this vulnerability.