CVE-2024-55601

What it actually does

Unescaped HTML attributes in Markdown content processed by internal render hooks for links, images, tables, and YouTube shortcodes allow injection of script or event handlers into generated static pages.

Why it matters to the business

Organizations using Hugo to publish sites from untrusted Markdown face risk that visitors' browsers execute attacker-controlled scripts, potentially damaging site credibility or enabling phishing.

How an attack unfolds

An attacker supplies Markdown files containing malicious attributes in link, image, table, or YouTube shortcode syntax; when Hugo builds the site the internal templates emit the attributes unescaped so that any visitor who loads the resulting page triggers the injected code in their browser.

How to fix it

Upgrade gohugoio/hugo to version 0.139.4 or later (commit 3afe91d4b1b069abbedd6a96ed755b1e12581dfe). As a temporary measure replace the four affected internal templates with custom versions or disable the internal render hooks.

How to confirm the fix worked

After upgrade, rebuild a test site containing the previously vulnerable Markdown patterns and inspect the generated HTML to confirm attributes are now escaped; verify the Hugo binary or module reports version 0.139.4 or newer.

Typical attack path

1. Identify a Hugo site whose Markdown sources are not fully trusted
2. Craft Markdown using render-link, render-image, render-table, or youtube shortcode syntax with payload attributes
3. Have the crafted Markdown included in the content tree or a shortcode
4. Trigger a site rebuild so the internal templates render the unescaped output
5. Wait for a victim to browse the published page and execute the injected script

How to detect it

Search build logs and published HTML for unescaped on* or javascript: attributes originating from Markdown; review git history of content files for recent additions of link, image, table, or youtube shortcode syntax with unusual attribute values.

What your security team should do

• Immediately upgrade all Hugo installations and CI pipelines to 0.139.4 or later
• Audit existing sites for use of the four listed internal templates and apply custom escaping templates where upgrade is delayed
• Add automated checks in content pipelines that reject Markdown containing suspicious attribute patterns until patched