CVE-2026-10618

Executive Summary

CVE-2026-10618 is a stored cross-site scripting (XSS) vulnerability in Hugo, the Gohugo static site generator. The default fenced-code-block renderer writes attribute values taken from the code-fence info string into rendered HTML without escaping them, allowing an attacker who can influence a content file to inject an event-handler attribute onto the code-block wrapper element. Every visitor loading the affected page executes the injected script in their browser; the flaw is reached under the default configuration (code fences enabled, no goldmark unsafe setting, no custom render hook), and a public PoC status is recorded.

Technical Analysis

Hugo renders fenced code blocks by extracting attributes from the "info string" that follows the opening fence (for example, attributes placed alongside the language identifier). In the affected component, a new file — markup/internal/attributes/attributes.go — was introduced that converts every attribute value from a byte slice to a string at storage time. The NVD description states this "deliberately drop[s] the escaping that used to happen there."

The consequence is twofold:

1. Escaping removed at ingestion. Previously, attribute values retained their byte-slice representation and were escaped during output. The refactor moves values into strings before rendering, so the escaping never occurs upstream.
2. Escaping branch is dead code at output. RenderAttributes in the same file escapes only values that are still byte slices. Because all values are now strings, that branch "is never reached and every value is written verbatim." The function's own documentation claims it performs HTML escaping of string attributes — it does not. This is a classic documentation-vs-implementation mismatch that made the defect easy to miss in review.

Attack mechanism. When an attribute value in the info string contains a double-quote, that quote escapes the intended attribute context and terminates it. The attacker then controls everything that follows within the wrapper element's tag, which permits a further attribute — specifically an inline event handler such as onmouseover / onload — to be added to that element (CWE-79, reflected/stored into generated markup).

Why name-based filtering does not stop it. Hugo filters attribute names beginning with on when attributes are parsed. However, the injection is carried through the attribute value, not the name, so the on* name filter is bypassed entirely.

Configuration reachability. The description is explicit that this path is reached with the default configuration: code fences enabled, goldmark's unsafe setting left off, and no custom render hook. This is important — operators may believe that avoiding unsafe: true protects them, but this vulnerability does not depend on that setting.

Rating rationale (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N — 5.4). Network-deliverable (AV:N), low attack complexity (AC:L) with low privileges required (PR:L, i.e., the ability to modify/contribute content), no user privileges needed but interaction required because a visitor must load the affected page (UI:R), scope is changed because the vulnerable component (build-time renderer) affects a different security authority (the visitor's browser) (S:C), and impact is limited to low confidentiality and integrity with no availability impact (C:L/I:L/A:N).

Epistemic note. The exact affected version range is not enumerated in the provided data (AffectedVersions: []; the OSV package hash is flagged →unfixed). The precise fix commit and released version are likewise unconfirmed. No public exploit code is available per the provided data.

Exploitation Scenarios

No public exploit code is provided in the source data. The following chain is described strictly at the level supported by the NVD description and is inferred from the stored-XSS vulnerability class; no additional function names, endpoints, or parameters are invented.

1. Reconnaissance / target identification. The attacker identifies a target site built with Hugo where content or code fences can be influenced — e.g., a documentation site, blog, wiki, or any deployment accepting community/markdown contributions, or an internal repo whose generated site is served to authenticated users. The attacker confirms that fenced code blocks are rendered under default settings and that no custom render hook rewrites attributes.

2. Triggering the flaw class. The attacker submits a markdown content change containing a fenced code block whose info string carries an attribute value that embeds a double-quote. Because RenderAttributes writes every string value verbatim (its escaping branch is unreachable), the quote terminates the attribute inside the code-block wrapper element's tag. The attacker then places an additional attribute carrying an inline event handler on that same wrapper element. Because Hugo's parser filters only attribute names beginning with on, the value-borne injection is not blocked. (Exact fence syntax and attribute names are intentionally not specified here, as they are not enumerated in the provided data.)

3. Payload / execution. The malicious markdown is committed and the site is rebuilt. The generated HTML now contains the injected event-handler attribute on the code-block wrapper. When any visitor's browser loads that page and the triggering event fires, the script runs in the origin's security context.

4. Post-exploitation impact. The injected script executes for every visitor who loads the page (per the NVD description). Typical stored-XSS outcomes follow: session/credential theft, DOM manipulation, malicious redirects, or drive-by actions — subject to the C:L/I:L impact ceilings and the scope change (S:C) noted in CVSS.

Impact Assessment

• Affected systems. Any Hugo-generated site served to users where a fenced code block can be influenced by a non-fully-trusted author, and where default rendering applies (fences on, no unsafe, no custom hook). Static sites are frequently assumed to be "safe by construction"; this CVE undermines that assumption at the build-render stage.
• Business impact. Injected scripts run in the origin of the deployed site. Depending on what that origin hosts — session cookies, admin panels proxied on the same domain, authentication flows — the real-world impact can exceed the nominal C:L/I:L. Documentation portals and developer sites are attractive targets for watering-hole and credential-phishing activity.
• Blast radius. Scope is Changed (S:C) because the vulnerable renderer (build-time) compromises a distinct authority (the end-user browser). Attack complexity is Low and privileges required are Low, meaning the barrier is "ability to land a content change," not exploit sophistication. User interaction is Required (UI:R) — the injected script only executes when a page is visited. Availability impact is None (A:N).
• Exploitation currency. Public PoC status is recorded; EPSS is 0.00215 (10.7th percentile), i.e., currently low predicted exploitation likelihood. CISA KEV: NO. No exploit code is listed.
• Reliability caveat. Affected version data is empty and the patch is only single-source-claimed; impact scoping to specific releases is therefore not possible from the provided intelligence.

Detection Guidance

Detections below target the observable artifacts of attribute-value breakout in rendered HTML and the resulting event-handler injection. They are generalized to the vulnerability class because the provided data does not enumerate fence syntax, attribute names, or endpoints.

Sigma Rule

YARA Rule

Suricata IDS Rule

Elastic Detection

Splunk SPL Query

Wazuh OSSEC Rule

Mitigation & Patch Guidance

Patch confidence: 2/4 — CLAIMED. A single source (RHSA) claims a patch, but no vendor fix, version number, or commit is recorded in the provided data, and the OSV package entry is flagged →unfixed. Treat the fix as unverified until a vendor advisory or release artifact confirms it. Verify SHA/signature before deployment.

1. Immediate mitigations (while the fix is unverified):
   • Restrict who can influence content. Since PR:L is the gating privilege, limit commit/PR rights on content directories and review markdown diffs for quote characters inside fenced-code info strings.
   • Sanitize rendered output at the edge. Apply a response-side HTML sanitizer or a strict Content-Security-Policy that forbids inline script (e.g., script-src 'self' / nonce-based), which neutralizes inline event handlers even if they are rendered. This is the most robust interim control.
   • Custom render hook. The description notes this path is reached without a custom render hook; deploying a render hook that escapes/validates fenced-code attributes removes the affected default path.
   • Do not rely on goldmark's unsafe setting as protection — the flaw reproduces with it off.
2. Patch / upgrade steps: Monitor Gohugo/Hugo release channels and the RHSA-referenced advisory for the confirmed fixed version; upgrade to that version once available, rebuild all sites so previously generated HTML is regenerated with escaping restored, and invalidate/purge CDN caches to evict any previously rendered malicious markup. Rebuild is mandatory — the vulnerability is baked into generated artifacts, not just the toolchain.
3. Long-term hardening: Add regression tests asserting that attribute values containing quotes are HTML-escaped; treat documentation claiming a function performs escaping as a testable contract; enforce CSP site-wide; and scan generated HTML post-build for on*= event-handler attributes on wrapper elements as a CI gate.

References

• NVD — CVE-2026-10618: https://nvd.nist.gov/vuln/detail/CVE-2026-10618
• CWE-79 (Improper Neutralization of Input During Web Page Generation — 'Cross-site Scripting'): https://cwe.mitre.org/data/definitions/79.html
• Gohugo / Hugo project: https://gohugo.io/
• OSV — package entry (flagged →unfixed in provided data): https://osv.dev/
• CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog — not listed

No threat actor campaigns or confirmed in-the-wild exploitation are documented in the provided data. Exploit status: Public PoC (no exploit code); CISA KEV: NO; EPSS: 0.00215 (10.7th percentile).