Hugo’s default code‑block renderer incorrectly inserts the Markdown fence language or info‑string straight into the class and data‑lang attributes without HTML escaping. A fence containing a quote followed by a script tag breaks out of the attribute and injects executable JavaScript into the rendered page. This result is a classic cross‑site scripting flaw that could let an attacker deliver malicious scripts to visitors, deface the site, steal session cookies or perform other client‑side attacks. The weakness is a typical example of unvalidated input leading to script injection (CWE‑79).

The vulnerability affects Hugo versions 0.60.0 through 0.163.2, released by gohugoio. Sites that publish Markdown pages using code fences with unsanitized language specifiers are vulnerable. Versions 0.163.3 and later include a fix that sanitises the language string before embedding it in HTML attributes.

The CVSS score of 5.1 indicates moderate severity, while the EPSS of less than 1% shows a very low probability of exploitation. Because the flaw is only triggered by the rendering of malicious Markdown content, the attack vector is confined to content authors or compromised content repositories rather than network‑level attackers. The vulnerability is not present in the CISA KEV catalog, but because it permits client‑side script execution it can be damaging if exploited, and the low EPSS suggests the threat is not widely present in the wild.