GHSA-4whp-jx7j-xvrm

The wrapperClass option of the built-in highlight shortcode (and the transform.Highlight template function) was written unescaped into the wrapping `

`, allowing a content author to inject arbitrary HTML/JavaScript into the rendered page.

markup/highlight/highlight.go (writeDivStart) wrote wrapperClass directly between class=" and ", while all other attribute values were HTML-escaped. Because the shortcode's options string is decoded into the highlight config, any content author can set wrapperClass. The Goldmark unsafe setting does not apply, as the value never passes through the Markdown HTML renderer. Markdown code fences are not affected.

Fixed by HTML-escaping the value.

Stored XSS for sites that render content from less-trusted authors. The highlight shortcode is built in and enabled by default.