Hugo EUVD-2026-64776

Exploitation requires that the attacker hold low-privilege content-authoring access to the Hugo site's Markdown source - for example, repository write access or equivalent CMS contributor rights (CVSS PR:L). The victim must actively load the rendered HTML page in a browser (CVSS UI:A). Hugo's default configuration is sufficient: code fences must be enabled (which they are by default) and no custom render hook for code blocks must be present (custom hooks would replace the vulnerable renderer). Goldmark's unsafe mode is NOT required and is unrelated. The on* attribute name filter does NOT prevent exploitation because injection is achieved through the attribute value, not the name. Exploitation is limited by: (1) the requirement for content-author access, which confines the threat to insiders or supply-chain/credential compromise scenarios; (2) the requirement for a human victim to visit the affected page; and (3) impact is scoped to the visitor's browser session rather than the Hugo build infrastructure.

The CVSS 4.0 score of 4.8 (Medium) accurately reflects the real-world risk profile: network-accessible (AV:N), low complexity (AC:L), but gated behind low-privilege content-author access (PR:L) and requiring a victim to actively load the page (UI:A). The stored nature of the XSS elevates practical impact relative to reflected variants - a single malicious markdown commit persists and fires for every subsequent visitor without further attacker interaction, which means even a modestly trafficked site operated by a mid-sized team such as a municipal portal or SME publisher faces meaningful user-impact scope. No EPSS score was available in the provided data, and the vulnerability is absent from CISA KEV, so there is no confirmed evidence of active exploitation at time of analysis. The primary real-world limiting factor is the PR:L requirement: exploitability depends on a threat actor having content-authoring access (e.g., a malicious or compromised contributor), which narrows the attack surface compared to unauthenticated injection. The CVSS 4.0 subsequent-system metrics (SC:L/SI:L) correctly capture that the confidentiality and integrity impact falls on victims' browser sessions rather than the Hugo build infrastructure itself.

An attacker with content-author access to a Hugo-based site (for example, a repository contributor or a compromised CI account) commits a Markdown file containing a fenced code block whose info string includes an attribute value with an embedded double-quote followed by an event handler, such as onclick=alert(document.cookie). Hugo processes the file and writes the unescaped string verbatim into the rendered HTML wrapper element. Every subsequent visitor who loads the generated page triggers the event handler and executes the injected JavaScript in their browser session.