Hugo's default fenced‑code‑block renderer writes attribute values taken from the code‑fence info string into the rendered HTML without performing escaping. The change in the internal attributes module caused the escaping routine to never trigger for string attributes, allowing a quote inside an attribute value to terminate the attribute and insert a new event handler on the wrapper element. The injected script executes for every visitor who loads the affected page, giving an attacker persistent client‑side code execution with the privileges of the page visitor.

The vulnerability affects Hugo versions 0.93.0 through 0.165.0, distributed by gohugoio. Any site built with one of these releases that contains or allows user‑generated markdown with fenced code blocks may be impacted. Sites that perform code‑block rendering with the default configuration, no unsafe goldmark option, and without custom render hooks are susceptible.

The CVSS score of 4.8 indicates a low to moderate severity. Because the EPSS score is not available and it is not listed in the CISA KEV catalog, there is no evidence of widespread exploitation yet. However, the attack can be performed without special privileges: an adversary only needs to place a malicious code fence in stored content, which makes this a straightforward stored XSS vector. The risk is mitigated by applying the latest patched version or by disabling the vulnerable rendering path.