CVE-2026-58402 gohugoio CVE debrief

Who should care

Users of Hugo static site generator, particularly those using versions between 0.60.0 and 0.163.3, should be aware of this vulnerability and take steps to mitigate it. This includes administrators, security teams, and operators who manage Hugo deployments, as they need to assess their exposure, apply updates, and monitor for potential exploitation. Additionally, vulnerability management teams should prioritize updating to Hugo version 0.163.3 or later to address this issue effectively.

Technical summary

The vulnerability in Hugo's default code-block renderer allows for code injection via Markdown code-fence language or info-string. This is due to the lack of HTML escaping in the code class=language-… data-lang=… wrapper. An attacker could exploit this by crafting a fence info-string with a quote and a script payload, which would break out of the attribute and inject a live script element. This issue affects users of Hugo static site generator, particularly those using versions between 0.60.0 and 0.163.3. The vulnerability has a CVSS score of 5.1 and a severity of MEDIUM, emphasizing the need for prompt attention and mitigation to prevent potential code injection attacks. To mitigate this vulnerability, users should update to Hugo version 0.163.3 or later. Additionally, reviewing and updating any affected sites is crucial to prevent potential exploitation.

Defensive priority

Medium priority should be given to updating Hugo to version 0.163.3 or later, as well as reviewing and updating any affected sites. Users should also monitor for suspicious activity on sites using affected Hugo versions and review compensating controls for exposed systems while remediation is scheduled and verified. Additionally, users should track exceptions, retest remediated assets, and close the item only after evidence is documented. Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up. Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed. Check relevant monitoring, detection, and logs for exposed assets that need extra review. Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance. Asset inventory and source tracking are also recommended to ensure thorough mitigation and response to this vulnerability. Review and update any affected sites to prevent potential exploitation. This vulnerability has a CVSS score of 5.1 and a severity of MEDIUM, emphasizing the need for prompt attention and mitigation to prevent potential code injection attacks. Hugo users must take proactive steps to secure their deployments against this issue. The NVD entry and CVE record provide further details for affected users and administrators. Users should prioritize updating to Hugo version 0.163.3 or later to address this vulnerability effectively. By taking these steps, users can help prevent potential code injection attacks and ensure the security of their Hugo deployments. It is essential to address this vulnerability promptly to minimize potential risks and impacts on affected systems and data. Hugo's default code-block renderer poses a risk if not updated to the latest version, and users must be proactive in mitigating this risk through recommended actions and updates. The vulnerability's impact can be mitigated by following the recommended actions and ensuring that affected systems are updated or patched accordingly. Users should also consider compensating controls and monitoring to detect potential exploitation of this

Recommended defensive actions

• Update Hugo to version 0.163.3 or later
• Review and update any affected sites
• Monitor for suspicious activity on sites using affected Hugo versions
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record was published on 2026-07-06T20:16:38.040Z and has been modified since then. The NVD entry is currently Undergoing Analysis. The vulnerability was fixed in Hugo version 0.163.3. Evidence is limited, and defenders should verify affected scope and vendor guidance. This issue is related to code injection via Markdown code-fence language or info-string. Users should review and update any affected sites. The CVE record and NVD entry provide further details.

Official resources