The Red Hat security advisory addresses vulnerabilities in the Hugo static site generator packaged in Red Hat Hardened Images RPMs version 0.163.3-0.1.hum1. The primary vulnerability (CVE-2026-58402) is a cross-site scripting (XSS) flaw where the default code block renderer fails to properly escape Markdown code-fence language or info-strings, allowing injection of malicious script elements into generated web pages. This can lead to arbitrary code execution within a user's browser. The advisory includes multiple CVEs related to Hugo but does not provide detailed patch information or fixed versions. The vulnerabilities are rated medium severity by Red Hat. No known exploits in the wild have been reported. The vendor advisory does not explicitly confirm a patch but references updated RPMs containing the fixes.

Successful exploitation of the XSS vulnerability could allow attackers to execute arbitrary scripts in the context of users' browsers visiting affected Hugo-generated sites. This may lead to disclosure of sensitive information such as cookies or session tokens, unauthorized actions performed on behalf of users, and potential compromise of user accounts. The impact is limited to client-side code execution within browsers and does not indicate server compromise. No known active exploitation has been reported.

The Red Hat advisory indicates updated RPMs for Hugo version 0.163.3-0.1.hum1 include the security fixes. Users should apply the provided updates from Red Hat Hardened Images RPMs to remediate these vulnerabilities. Since no explicit fixed version is stated, users should follow Red Hat's official update channels and instructions at https://images.redhat.com/ for applying the security update. No additional mitigations are specified or required beyond applying the update.