EUVD-2026-87664

Hugo versions 0.75.0 through 0.165.x contain a stored cross-site scripting vulnerability: the syntax highlighter does not escape the lineAnchors option before passing it to Chroma, which writes the value verbatim into the id and href attributes of the generated line-number markup. A crafted...

PT-2026-99362

Name of the Vulnerable Software and Affected Versions Hugo versions 0.75.0 through 0.165.x Description A stored cross-site scripting issue exists because the syntax highlighter fails to escape the lineAnchors option before passing it to Chroma. This causes the value to be written verbatim into th...

github.com/gohugoio/hugo: Hugo: Stored Cross-Site Scripting via unescaped code-fence attribute values

A flaw was found in Hugo's default fenced-code-block renderer. This vulnerability allows a remote attacker to inject arbitrary script code into the rendered HTML by providing specially crafted input in the code-fence info string. Due to improper escaping of attribute values, a malicious quote can...

Ruby on Rails: Action Text to_markdown: <code>/<pre> content escapes its delimiter, letting a stored body inject arbitrary Markdown

Summary ActionText::Contenttomarkdown escapes text nodes so that a stored rich text body cannot turn into Markdown syntax. Text whose immediate parent is or is exempt from that escaping MarkdownConversion::SKIPESCAPINGPARENTS and is instead kept inert by the delimiter its visitor wraps around it...

GHSA-J8PM-GJ4C-RQ4X league/commonmark: Denial of service via crafted code fences, reference links, and emphasis delimiters

Impact Affected versions of league/commonmark perform super-linear work on three independent parsing paths, all of which are reachable on a stock new CommonMarkConverter with default configuration and no extensions registered. Each trigger fits on a single line of input, so no complex Markdown...

CVE-2026-10618

A flaw was found in Hugo's default fenced-code-block renderer. This vulnerability allows a remote attacker to inject arbitrary script code into the rendered HTML by providing specially crafted input in the code-fence info string. Due to improper escaping of attribute values, a malicious quote can...

Linux Distros Unpatched Vulnerability : CVE-2026-10618

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Hugo's default fenced-code-block renderer writes attribute values taken from the code-fence info string into the rendered HTML without escaping them. New in...

DEBIAN-CVE-2026-10618

Hugo's default fenced-code-block renderer writes attribute values taken from the code-fence info string into the rendered HTML without escaping them. New in markup/internal/attributes/attributes.go converts every attribute value from a byte slice to a string as it is stored, deliberately dropping...

CVE-2026-10618

Hugo versions 0.93.0 through 0.165.0 are affected by a stored cross-site scripting vulnerability in the default fenced-code-block renderer. The root cause is in markup/internal/attributes/attributes.go: the New function converts attribute values from byte slices to strings before storage, bypassi...

CVE-2026-10618 Hugo 0.93.0 through 0.165.0 Stored Cross-Site Scripting via Unescaped Code-Fence Attribute Values

Hugo's default fenced-code-block renderer writes attribute values taken from the code-fence info string into the rendered HTML without escaping them. New in markup/internal/attributes/attributes.go converts every attribute value from a byte slice to a string as it is stored, deliberately dropping...

EUVD-2026-64776

Hugo's default fenced-code-block renderer writes attribute values taken from the code-fence info string into the rendered HTML without escaping them. New in markup/internal/attributes/attributes.go converts every attribute value from a byte slice to a string as it is stored, deliberately dropping...

CVE-2026-10618 Hugo 0.93.0 through 0.165.0 Stored Cross-Site Scripting via Unescaped Code-Fence Attribute Values

Hugo's default fenced-code-block renderer writes attribute values taken from the code-fence info string into the rendered HTML without escaping them. New in markup/internal/attributes/attributes.go converts every attribute value from a byte slice to a string as it is stored, deliberately dropping...

PT-2026-80796

Hugo's default fenced-code-block renderer writes attribute values taken from the code-fence info string into the rendered HTML without escaping them. New in markup/internal/attributes/attributes.go converts every attribute value from a byte slice to a string as it is stored, deliberately dropping...

CVE-2026-5389

justhtml versions before 1.13.0 contain a cross-site scripting vulnerability in the tomarkdown function when serializing attacker-controlled pre content. Attackers can place backticks inside sanitized pre elements to break out of fixed-length code fences, allowing raw HTML to execute when the...

CVE-2026-5389 justhtml before 1.13.0 XSS via code fence breakout

justhtml versions before 1.13.0 contain a cross-site scripting vulnerability in the tomarkdown function when serializing attacker-controlled pre content. Attackers can place backticks inside sanitized pre elements to break out of fixed-length code fences, allowing raw HTML to execute when the...

CVE-2026-5389 justhtml before 1.13.0 XSS via code fence breakout

justhtml versions before 1.13.0 contain a cross-site scripting vulnerability in the tomarkdown function when serializing attacker-controlled pre content. Attackers can place backticks inside sanitized pre elements to break out of fixed-length code fences, allowing raw HTML to execute when the...

EUVD-2026-64653

justhtml versions before 1.13.0 contain a cross-site scripting vulnerability in the tomarkdown function when serializing attacker-controlled pre content. Attackers can place backticks inside sanitized pre elements to break out of fixed-length code fences, allowing raw HTML to execute when the...

CVE-2026-5389 justhtml before 1.13.0 XSS via code fence breakout

justhtml versions before 1.13.0 contain a cross-site scripting vulnerability in the tomarkdown function when serializing attacker-controlled pre content. Attackers can place backticks inside sanitized pre elements to break out of fixed-length code fences, allowing raw HTML to execute when the...

CVE-2026-5389

justhtml versions before 1.13.0 are affected by a cross-site scripting (XSS) vulnerability in the to_markdown() function. The root cause is that attacker-controlled content inside sanitized elements can contain backticks that break out of fixed-length code fences. When the resulting Markdown is ...

PT-2026-79770

justhtml versions before 1.13.0 contain a cross-site scripting vulnerability in the to markdown function when serializing attacker-controlled pre content. Attackers can place backticks inside sanitized pre elements to break out of fixed-length code fences, allowing raw HTML to execute when the...