Hugo versions from 0.60.0 until 0.163.3 have an XSS vulnerability (CWE-79) in the default code-block renderer. The renderer inserts the Markdown code-fence language or info-string directly into the code element's class and data-lang attributes without HTML escaping. If an attacker crafts a fence info-string containing a quote and a script payload, it can break out of the attribute context and inject executable script code into the generated page. This vulnerability is addressed in version 0.163.3.

An attacker can inject malicious scripts into pages generated by vulnerable Hugo versions, potentially leading to cross-site scripting attacks when users view the affected pages. This can result in execution of arbitrary scripts in the context of the site, impacting confidentiality and integrity of user interactions. The CVSS 4.0 base score is 5.1 (medium severity), reflecting network attack vector, low complexity, and limited privileges required.

Upgrade to Hugo version 0.163.3 or later, where this vulnerability is fixed by properly escaping the code-fence language/info-string before inserting it into HTML attributes. No other mitigation or temporary workaround is indicated in the available data.