Description

Hugo's default fenced-code-block renderer writes attribute values taken from the code-fence info string into the rendered HTML without escaping them. New in markup/internal/attributes/attributes.go converts every attribute value from a byte slice to a string as it is stored, deliberately dropping the escaping that used to happen there, and RenderAttributes in the same file escapes only values that are still byte slices, so its escaping branch is never reached and every value is written verbatim. The function's documentation states that it performs HTML escaping of string attributes, which it does not. A quote inside an attribute value in the info string therefore terminates the attribute and allows a further attribute, including an event handler, to be placed on the wrapper element, and the script runs for every visitor who loads the page. This path is reached under the default configuration, with code fences enabled and without goldmark's unsafe setting or any custom render hook. Attribute names beginning with on are filtered when the attributes are parsed, so injection is achieved through the value rather than the name.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.4",
  "pubDate": "2026-08-24T11:16:38.403Z",
  "pubdate": "2026-08-24T11:16:38.403Z",
  "executiveSummary": "A Cross-Site Scripting (XSS) vulnerability exists in Hugo's default fenced-code-block renderer, which improperly handles attribute values extracted from code-fence info strings. The vulnerability allows an attacker to inject arbitrary HTML attributes and event handlers into the rendered wrapper element.\nThe impact of successful exploitation includes arbitrary script execution in the context of any visitor loading the affected web page. This can lead to session hijacking, credential theft, or malicious modification of page content.\nThe affected product is Hugo, specifically impacting the default configuration with code fences enabled, without requiring goldmark's unsafe setting or custom render hooks.\nThe risk implications are significant because the attack path is reachable under default settings and requires no authentication or special privileges. An attacker with the ability to supply content to the site can achieve code execution.\nAttacker capabilities include injecting quotes and subsequent event handlers into attribute values. Exploitation requirements involve supplying a crafted code-fence info string containing malicious attribute payloads.",
  "technicalDetails": "The root cause of the vulnerability resides in markup/internal/attributes/attributes.go, where attribute values derived from code-fence info strings are converted from byte slices to strings upon storage. This type conversion deliberately drops the escaping mechanism that previously occurred.\nThe vulnerable component is the RenderAttributes function within markup/internal/attributes/attributes.go. The function only escapes values that remain as byte slices. Because all attribute values are converted to strings during storage, the byte-slice check fails, the escaping branch is never reached, and every attribute value is written verbatim to the rendered HTML.\nDespite function documentation stating that it performs HTML escaping of string attributes, the implementation fails to do so. Although attribute names beginning with on are filtered during parsing, injection is successfully achieved through the attribute value rather than the name.\nThe step-by-step attack flow proceeds as follows: First, an attacker supplies a crafted markdown code fence with an info string containing a quote character. Second, the quote terminates the current attribute value prematurely within the rendered HTML wrapper element. Third, the attacker appends additional malicious attributes, including event handlers such as onload or onerror, which bypass the attribute name filter by residing in the injected value space. Fourth, the HTML is rendered without escaping, outputting the attacker-controlled attributes directly into the DOM under default configuration settings without requiring goldmark's unsafe setting or custom render hooks. Finally, the injected script executes automatically for every visitor who loads the affected page, leading to persistent client-side code execution."
}