The advisory covers multiple CVEs affecting Red Hat Hardened Images RPMs, notably CVE-2026-10618 in Hugo version 0.166.0-0.1.hum1. The vulnerability arises from Hugo's default fenced-code-block renderer writing unescaped attribute values from the code-fence info string into HTML. A crafted quote character can terminate an attribute and inject additional attributes, including event handlers, enabling stored cross-site scripting. This flaw is exploitable under default Hugo configurations without requiring unsafe settings or custom render hooks. The impact includes client-side arbitrary code execution for visitors of affected pages. Red Hat provides updated RPMs to remediate the issue and recommends disabling code-fence attribute support or using custom render hooks as workarounds.

The vulnerability allows remote attackers to inject arbitrary script code into HTML rendered by Hugo, leading to stored cross-site scripting (XSS). This can result in execution of malicious scripts in the context of users visiting affected pages, potentially compromising user data such as cookies and session information. The flaw affects confidentiality and integrity by enabling unauthorized code execution and data disclosure. There are no reports of active exploitation in the wild. The impact is rated high due to the potential for client-side code execution and data compromise.

Red Hat has released updated RPM packages including hugo-0.166.0-0.1.hum1 that fix the vulnerability. Users should apply these updates promptly. As a workaround, disable code-fence attribute support in Hugo's goldmark configuration by setting markup.highlight.codeFences to false, or implement a custom render hook that properly escapes attribute values before HTML output. No other actions are required if the update is applied.