CVE-2026-10618

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-10618", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-06-02T13:53:48.666Z", "datePublished": "2026-08-24T10:29:10.191Z", "dateUpdated": "2026-08-26T18:20:58.149Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-08-24T11:13:21.240Z"}, "datePublic": "2026-08-12T00:00:00.000Z", "title": "Hugo 0.93.0 through 0.165.0 Stored Cross-Site Scripting via Unescaped Code-Fence Attribute Values", "descriptions": [{"lang": "en", "value": "Hugo's default fenced-code-block renderer writes attribute values taken from the code-fence info string into the rendered HTML without escaping them. New in markup/internal/attributes/attributes.go converts every attribute value from a byte slice to a string as it is stored, deliberately dropping the escaping that used to happen there, and RenderAttributes in the same file escapes only values that are still byte slices, so its escaping branch is never reached and every value is written verbatim. The function's documentation states that it performs HTML escaping of string attributes, which it does not. A quote inside an attribute value in the info string therefore terminates the attribute and allows a further attribute, including an event handler, to be placed on the wrapper element, and the script runs for every visitor who loads the page. This path is reached under the default configuration, with code fences enabled and without goldmark's unsafe setting or any custom render hook. Attribute names beginning with on are filtered when the attributes are parsed, so injection is achieved through the value rather than the name."}], "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-79", "description": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "type": "CWE"}]}], "affected": [{"vendor": "gohugoio", "product": "hugo", "collectionURL": "https://github.com/gohugoio/hugo", "defaultStatus": "unaffected", "versions": [{"version": "0.93.0", "lessThanOrEqual": "0.165.0", "status": "affected", "versionType": "semver"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:gohugo:hugo:*:*:*:*:*:*:*:*", "versionStartIncluding": "0.93.0", "versionEndIncluding": "0.165.0"}]}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N", "baseScore": 4.8, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "ACTIVE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "LOW", "subAvailabilityImpact": "NONE"}}, {"format": "CVSS", "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "baseScore": 5.4, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "REQUIRED", "scope": "CHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "NONE"}}], "references": [{"url": "https://github.com/gohugoio/hugo", "tags": ["product"]}, {"url": "https://github.com/gohugoio/hugo/blob/v0.165.0/markup/internal/attributes/attributes.go", "tags": ["technical-description"]}, {"url": "https://github.com/gohugoio/hugo/blob/v0.165.0/markup/goldmark/codeblocks/render.go", "tags": ["technical-description"]}, {"url": "https://github.com/gohugoio/hugo/blob/v0.165.0/markup/highlight/highlight.go", "tags": ["technical-description"]}, {"name": "VulnCheck Advisory: Hugo 0.93.0 through 0.165.0 Stored Cross-Site Scripting via Unescaped Code-Fence Attribute Values", "tags": ["third-party-advisory"], "url": "https://www.vulncheck.com/advisories/hugo-through-stored-cross-site-scripting-via-unescaped-code-fence-attribute-values"}], "credits": [{"lang": "en", "value": "Michael Holmquist", "type": "finder"}], "x_generator": {"engine": "vulncheck-endgame"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-26T18:20:48.410725Z", "id": "CVE-2026-10618", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-26T18:20:58.149Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-10618", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-26T18:20:48.410725Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-26T18:20:53.855Z"}}], "cna": {"title": "Hugo 0.93.0 through 0.165.0 Stored Cross-Site Scripting via Unescaped Code-Fence Attribute Values", "credits": [{"lang": "en", "type": "finder", "value": "Michael Holmquist"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "baseScore": 4.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N", "userInteraction": "ACTIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "LOW", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "vulnConfidentialityImpact": "LOW"}}, {"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "gohugoio", "product": "hugo", "versions": [{"status": "affected", "version": "0.93.0", "versionType": "semver", "lessThanOrEqual": "0.165.0"}], "collectionURL": "https://github.com/gohugoio/hugo", "defaultStatus": "unaffected"}], "datePublic": "2026-08-12T00:00:00.000Z", "references": [{"url": "https://github.com/gohugoio/hugo", "tags": ["product"]}, {"url": "https://github.com/gohugoio/hugo/blob/v0.165.0/markup/internal/attributes/attributes.go", "tags": ["technical-description"]}, {"url": "https://github.com/gohugoio/hugo/blob/v0.165.0/markup/goldmark/codeblocks/render.go", "tags": ["technical-description"]}, {"url": "https://github.com/gohugoio/hugo/blob/v0.165.0/markup/highlight/highlight.go", "tags": ["technical-description"]}, {"url": "https://www.vulncheck.com/advisories/hugo-through-stored-cross-site-scripting-via-unescaped-code-fence-attribute-values", "name": "VulnCheck Advisory: Hugo 0.93.0 through 0.165.0 Stored Cross-Site Scripting via Unescaped Code-Fence Attribute Values", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "vulncheck-endgame"}, "descriptions": [{"lang": "en", "value": "Hugo's default fenced-code-block renderer writes attribute values taken from the code-fence info string into the rendered HTML without escaping them. New in markup/internal/attributes/attributes.go converts every attribute value from a byte slice to a string as it is stored, deliberately dropping the escaping that used to happen there, and RenderAttributes in the same file escapes only values that are still byte slices, so its escaping branch is never reached and every value is written verbatim. The function's documentation states that it performs HTML escaping of string attributes, which it does not. A quote inside an attribute value in the info string therefore terminates the attribute and allows a further attribute, including an event handler, to be placed on the wrapper element, and the script runs for every visitor who loads the page. This path is reached under the default configuration, with code fences enabled and without goldmark's unsafe setting or any custom render hook. Attribute names beginning with on are filtered when the attributes are parsed, so injection is achieved through the value rather than the name."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:gohugo:hugo:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndIncluding": "0.165.0", "versionStartIncluding": "0.93.0"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-08-24T11:13:21.240Z"}}}, "cveMetadata": {"cveId": "CVE-2026-10618", "state": "PUBLISHED", "dateUpdated": "2026-08-26T18:20:58.149Z", "dateReserved": "2026-06-02T13:53:48.666Z", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "datePublished": "2026-08-24T10:29:10.191Z", "assignerShortName": "VulnCheck"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://github.com/gohugoio/hugo", "defaultStatus": "unaffected", "product": "hugo", "vendor": "gohugoio", "versions": [{"lessThanOrEqual": "0.165.0", "status": "affected", "version": "0.93.0", "versionType": "semver"}]}], "source": "disclosure@vulncheck.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:gohugo:hugo:*:*:*:*:*:*:*:*", "matchCriteriaId": "FAC91C38-6B4F-4C29-B67B-E5B557A9CECC", "versionEndExcluding": "0.165.0", "versionStartIncluding": "0.93.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Hugo's default fenced-code-block renderer writes attribute values taken from the code-fence info string into the rendered HTML without escaping them. New in markup/internal/attributes/attributes.go converts every attribute value from a byte slice to a string as it is stored, deliberately dropping the escaping that used to happen there, and RenderAttributes in the same file escapes only values that are still byte slices, so its escaping branch is never reached and every value is written verbatim. The function's documentation states that it performs HTML escaping of string attributes, which it does not. A quote inside an attribute value in the info string therefore terminates the attribute and allows a further attribute, including an event handler, to be placed on the wrapper element, and the script runs for every visitor who loads the page. This path is reached under the default configuration, with code fences enabled and without goldmark's unsafe setting or any custom render hook. Attribute names beginning with on are filtered when the attributes are parsed, so injection is achieved through the value rather than the name."}, {"lang": "es", "value": "El renderizador predeterminado de bloques de c\u00f3digo vallados de Hugo escribe los valores de atributos tomados de la cadena de informaci\u00f3n de la valla de c\u00f3digo en el HTML renderizado sin escaparlos. Lo nuevo en markup/internal/attributes/attributes.go convierte cada valor de atributo de un segmento de bytes a una cadena a medida que se almacena, eliminando deliberadamente el escape que sol\u00eda ocurrir all\u00ed, y RenderAttributes en el mismo archivo escapa solo los valores que a\u00fan son segmentos de bytes, por lo que su rama de escape nunca se alcanza y cada valor se escribe textualmente. La documentaci\u00f3n de la funci\u00f3n establece que realiza el escape HTML de los atributos de cadena, lo cual no hace. Una comilla dentro de un valor de atributo en la cadena de informaci\u00f3n, por lo tanto, termina el atributo y permite que un atributo adicional, incluyendo un gestor de eventos, se coloque en el elemento contenedor, y el script se ejecuta para cada visitante que carga la p\u00e1gina. Esta ruta se alcanza bajo la configuraci\u00f3n predeterminada, con las vallas de c\u00f3digo habilitadas y sin la configuraci\u00f3n unsafe de goldmark ni ning\u00fan render hook personalizado. Los nombres de atributos que comienzan con on se filtran cuando se analizan los atributos, por lo que la inyecci\u00f3n se logra a trav\u00e9s del valor en lugar del nombre."}], "id": "CVE-2026-10618", "lastModified": "2026-10-12T15:10:00.207", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 2.7, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 4.8, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "LOW", "userInteraction": "ACTIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-10618", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-08-26T18:20:48.410725Z", "version": "2.0.3"}}]}, "published": "2026-08-24T11:16:38.403", "references": [{"source": "disclosure@vulncheck.com", "tags": ["Product"], "url": "https://github.com/gohugoio/hugo"}, {"source": "disclosure@vulncheck.com", "tags": ["Product"], "url": "https://github.com/gohugoio/hugo/blob/v0.165.0/markup/goldmark/codeblocks/render.go"}, {"source": "disclosure@vulncheck.com", "tags": ["Product"], "url": "https://github.com/gohugoio/hugo/blob/v0.165.0/markup/highlight/highlight.go"}, {"source": "disclosure@vulncheck.com", "tags": ["Product"], "url": "https://github.com/gohugoio/hugo/blob/v0.165.0/markup/internal/attributes/attributes.go"}, {"source": "disclosure@vulncheck.com", "tags": ["Third Party Advisory"], "url": "https://www.vulncheck.com/advisories/hugo-through-stored-cross-site-scripting-via-unescaped-code-fence-attribute-values"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "disclosure@vulncheck.com", "type": "Secondary"}]}

{"bugzilla": {"description": "github.com/gohugoio/hugo: Hugo: Stored Cross-Site Scripting via unescaped code-fence attribute values", "id": "2521802", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2521802"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.4", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "status": "draft"}, "cwe": "CWE-79", "details": ["Hugo's default fenced-code-block renderer writes attribute values taken from the code-fence info string into the rendered HTML without escaping them. New in markup/internal/attributes/attributes.go converts every attribute value from a byte slice to a string as it is stored, deliberately dropping the escaping that used to happen there, and RenderAttributes in the same file escapes only values that are still byte slices, so its escaping branch is never reached and every value is written verbatim. The function's documentation states that it performs HTML escaping of string attributes, which it does not. A quote inside an attribute value in the info string therefore terminates the attribute and allows a further attribute, including an event handler, to be placed on the wrapper element, and the script runs for every visitor who loads the page. This path is reached under the default configuration, with code fences enabled and without goldmark's unsafe setting or any custom render hook. Attribute names beginning with on are filtered when the attributes are parsed, so injection is achieved through the value rather than the name.", "A flaw was found in Hugo's default fenced-code-block renderer. This vulnerability allows a remote attacker to inject arbitrary script code into the rendered HTML by providing specially crafted input in the code-fence info string. Due to improper escaping of attribute values, a malicious quote can terminate an attribute and allow the injection of additional attributes, including event handlers. This can lead to client-side arbitrary code execution when a user views the affected page."], "mitigation": {"lang": "en:us", "value": "Update to a fixed version of Hugo. As a workaround, disable code-fence attribute support in the goldmark configuration by setting markup.highlight.codeFences to false, or use a custom render hook that explicitly escapes attribute values before writing them to HTML output."}, "name": "CVE-2026-10618", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "grafana", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Not affected", "package_name": "grafana12.4", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Not affected", "package_name": "grafana13.1", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Not affected", "package_name": "grafana13.2", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Affected", "package_name": "hugo", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:openshift_gitops:1", "fix_state": "Fix deferred", "package_name": "openshift-gitops-1/argocd-rhel8", "product_name": "Red Hat OpenShift GitOps"}, {"cpe": "cpe:/a:redhat:openshift_gitops:1", "fix_state": "Fix deferred", "package_name": "openshift-gitops-1/argocd-rhel9", "product_name": "Red Hat OpenShift GitOps"}, {"cpe": "cpe:/a:redhat:openstack:18.0", "fix_state": "Fix deferred", "package_name": "rhoso-operators/openstack-operator-bundle", "product_name": "Red Hat OpenStack Platform 18.0"}], "public_date": "2026-08-24T10:29:10Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-10618\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-10618\nhttps://github.com/gohugoio/hugo\nhttps://github.com/gohugoio/hugo/blob/v0.165.0/markup/goldmark/codeblocks/render.go\nhttps://github.com/gohugoio/hugo/blob/v0.165.0/markup/highlight/highlight.go\nhttps://github.com/gohugoio/hugo/blob/v0.165.0/markup/internal/attributes/attributes.go\nhttps://www.vulncheck.com/advisories/hugo-through-stored-cross-site-scripting-via-unescaped-code-fence-attribute-values"], "statement": "A flaw was found in Hugo. The default fenced-code-block renderer writes attribute values from the code-fence info string into HTML without escaping them. A crafted quote character inside an attribute value terminates the attribute in the rendered HTML, allowing injection of additional attributes including event handlers. The injected script executes for every visitor who loads the page. This is exploitable under the default Hugo configuration with code fences enabled, without requiring the goldmark unsafe setting or any custom render hook. Note that attribute names beginning with 'on' are filtered during parsing, but injection is achieved through the attribute value rather than the name.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0.93.0,0.165.0]"}}], "enrichment": {"confidence": 92.0, "confidence_source": "matching", "scores": [{"score": 92.0, "source": "matching"}]}, "original": {"product": "hugo", "source": "cna", "vendor": "gohugoio"}, "product": "hugo", "vendor": "gohugo"}], "created": "2026-08-24T11:30:03.585359+00:00", "updated": "2026-08-24T21:00:12.161828+00:00", "vendors": ["gohugo", "gohugo$PRODUCT$hugo"]}