Most recent entries from all

EUVD-2026-333538

fkie_cve-2026-58402

Hugo is a static site generator. From 0.60.0 until 0.163.3, Hugo's default code-block renderer wrote the Markdown code-fence language or info-string into the code class="language-…" data-lang="…" wrapper without HTML escaping. A fence info-string containing a quote and a script payload breaks out of the attribute and injects a live script element. This issue is fixed in 0.163.3.

GHSA-q76j-gcg9-vxc6 — Hugo: XSS via unescaped code-fence language in default code block renderer

Affected: Go: github.com/gohugoio/hugo

Hugo's default code-block renderer wrote the Markdown code-fence language / info-string into the `<code class="language-…" data-lang="…">` wrapper without HTML escaping. A fence info-string containing a quote and a `<script>` payload breaks out of the attribute and injects a live script element.

This is not an issue if you fully trust every file under /content and every content adapter you load.

RHSA-2026:36862 — Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

github.com/gohugoio/hugo: Hugo: Cross-site Scripting via untrusted HTML content files github.com/gohugoio/hugo: Hugo: Cross-site Scripting via unescaped code-fence language in default code block renderer github.com/gohugoio/hugo: Hugo: Information disclosure via symlink confinement bypass in virtual filesystem github.com/gohugoio/hugo: Hugo: Server-Side Request Forgery (SSRF) via alternate IPv4 encodings

UBUNTU-CVE-2026-58402

Affected: Ubuntu:16.04:LTS: hugo, Ubuntu:18.04:LTS: hugo, Ubuntu:20.04:LTS: hugo, Ubuntu:22.04:LTS: hugo, Ubuntu:Pro:24.04:LTS: hugo, Ubuntu:25.10: hugo, Ubuntu:26.04:LTS: hugo