From ce1a7e0bce3713af40496ded3c2c0ceeed49231d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Bj=C3=B8rn=20Erik=20Pedersen?=
 <bjorn.erik.pedersen@gmail.com>
Date: Thu, 18 Jun 2026 13:48:46 +0200
Subject: [PATCH] markup/highlight: Escape lang in default code block rendering

---
 .../codeblocks/codeblocks_integration_test.go | 29 +++++++++++++++++++
 markup/highlight/highlight.go                 |  2 ++
 2 files changed, 31 insertions(+)

diff --git a/markup/goldmark/codeblocks/codeblocks_integration_test.go b/markup/goldmark/codeblocks/codeblocks_integration_test.go
index 7a0450704..f3bd18436 100644
--- a/markup/goldmark/codeblocks/codeblocks_integration_test.go
+++ b/markup/goldmark/codeblocks/codeblocks_integration_test.go
@@ -408,3 +408,32 @@ Some code.
 
 	b.AssertFileContent("public/p1/index.html", "p1.md:7:1")
 }
+
+func TestCodeblockLangEscape(t *testing.T) {
+	t.Parallel()
+
+	files := `
+-- hugo.toml --
+-- layouts/single.html --
+{{ .Content }}
+-- content/p1.md --
+---
+title: "p1"
+---
+
+## Simple
+
+§§§a"><script>A</script>
+Some code.
+§§§
+
+§§§a"><script>B</script> {hl_inline=true}
+Some code.
+§§§
+
+`
+
+	b := hugolib.Test(t, files)
+
+	b.AssertFileContent("public/p1/index.html", "! <script>")
+}
diff --git a/markup/highlight/highlight.go b/markup/highlight/highlight.go
index 77bc52cf0..44489809a 100644
--- a/markup/highlight/highlight.go
+++ b/markup/highlight/highlight.go
@@ -275,6 +275,7 @@ func (p *preWrapper) Start(code bool, styleAttr string) string {
 }
 
 func inlineCodeAttrs(lang string) string {
+	lang = gohtml.EscapeString(lang)
 	return fmt.Sprintf(` class="code-inline language-%s"`, lang)
 }
 
@@ -282,6 +283,7 @@ func WritePreStart(w io.Writer, language, styleAttr string) {
 	fmt.Fprintf(w, `<pre tabindex="0"%s>`, styleAttr)
 	fmt.Fprint(w, "<code")
 	if language != "" {
+		language = gohtml.EscapeString(language)
 		fmt.Fprint(w, ` class="language-`+language+`"`)
 		fmt.Fprint(w, ` data-lang="`+language+`"`)
 	}