Hono <4.13.7 XSS via unescaped strings in hono/jsx rendering
CVE-2026-93981 Published on September 19, 2026
hono/jsx before 4.13.7 Cross-Site Scripting via Unescaped Strings
hono before 4.13.7 fails to HTML-escape plain strings rendered by hono/jsx as a child or fallback of Suspense, as a string child of ErrorBoundary alongside an asynchronous sibling, as the single child of a Context.Provider, or as the root value passed to renderToString() or renderToReadableStream() from hono/jsx/dom/server. These paths stringify their input and treat the result as already-escaped markup, so an attacker who controls such a string during server-side rendering can inject arbitrary HTML and execute script under the application's origin.
Vulnerability Analysis
CVE-2026-93981 can be exploited with network access. This vulnerability is consided to have a high level of attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity and availability.
Weakness Type
What is a XSS Vulnerability?
The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVE-2026-93981 has been classified to as a XSS vulnerability or weakness.
Products Associated with CVE-2026-93981
Want to know whenever a new CVE is published for Hono? stack.watch will email you.
Affected Versions
honojs hono:- Before 4.13.7 is affected.
- Version 4.13.7 is unaffected.