Go/github.com/gohugoio/hugo CVE-2026-58402: medium, EPSS 0.30%

Hugo: XSS via unescaped code-fence language in default code block renderer

Action: Upgrade github.com/gohugoio/hugo to 0.163.3 or later.

go get github.com/gohugoio/hugo@v0.163.3

Affected

Fixed versions

Sources

• osv: GHSA-q76j-gcg9-vxc6
• https://github.com/gohugoio/hugo/security/advisories/GHSA-q76j-gcg9-vxc6
• https://github.com/gohugoio/hugo

CVE-2026-58402 · published 2026-06-19T17:45:27Z · modified 2026-07-24T19:11:31.045540965Z · JSON