rootpwn

medium · CVSS v3 4.7 · CVSS v4 2.3

CVE-2026-93981

Hono before version 4.13.7 fails to properly HTML-escape plain strings under specific JSX rendering conditions such as Suspense, ErrorBounda

Overview

Hono before version 4.13.7 fails to properly HTML-escape plain strings under specific JSX rendering conditions such as Suspense, ErrorBoundary, and Context.Providers. This oversight causes the framework to treat attacker-controlled input as pre-escaped markup during server-side rendering. Consequently, applications are vulnerable to cross-site scripting (XSS) via HTML injection under the origin.

Description

hono before 4.13.7 fails to HTML-escape plain strings rendered by hono/jsx as a child or fallback of Suspense, as a string child of ErrorBoundary alongside an asynchronous sibling, as the single child of a Context.Provider, or as the root value passed to renderToString() or renderToReadableStream() from hono/jsx/dom/server. These paths stringify their input and treat the result as already-escaped markup, so an attacker who controls such a string during server-side rendering can inject arbitrary HTML and execute script under the application's origin.

Impact

The vulnerability primarily impacts the integrity and confidentiality of web applications by enabling stored or reflected cross-site scripting via server-side rendering (SSR). An attacker who can influence string inputs in affected JSX components can execute arbitrary scripts within the victim's browser session. Users viewing affected pages and administrators maintaining the web application are directly impacted.

Remediation

Upgrade the Hono framework to version 4.13.7 or higher where the HTML-escaping logic for these specific JSX paths has been corrected. Review application code utilizing `hono/jsx` and `hono/jsx/dom/server` to ensure user-supplied data is explicitly sanitized before rendering. Monitor dependency update alerts across your software supply chain.

Risk context

This vulnerability carries a medium CVSS v3 score of 4.7 and a CVSS v4 score of 2.3, indicating moderate technical severity. No EPSS score is currently available, but remediation is recommended promptly to prevent potential client-side code execution in SSR environments.

Affected products

  • Hono < 4.13.7

Scores

Severity
medium
CVSS v2
4
CVSS v3
4.7
CVSS v4
2.3
EPSS
—

cve hono xss ssr jsx html-injection web-security

← All CVEs

Related CVEs

medium

CVE-2026-89333

The Tutor LMS plugin for WordPress contains an Insecure Direct Object Reference (IDOR) vulnerability in versions up to and including 4.0.8. The flaw exists due to missing validation on the 'student_id' parameter. This allows authenticated attackers with subscriber-level access to harvest sensitive user information, including emails and phone numbers, by iterating through user IDs.

View analysis

medium

CVE-2026-89334

An authorization bypass vulnerability exists in the Better Messages WordPress plugin up to version 2.15.33 due to improper privilege verification. The flaw allows authenticated users with custom-level access or higher to read unauthorized chat transcripts, thread metadata, and user data. This occurs when specific default chat room settings remain unconfigured.

View analysis

medium

CVE-2026-91847

The Online Scheduling and Appointment Booking System WordPress plugin before version 28.2 fails to validate conversation ownership during unauthenticated AI booking-assistant actions. This flaw allows unauthenticated visitors to read and inject messages into other users' active conversations. It matters because it exposes private communications within the scheduling interface.

View analysis

medium

CVE-2026-92099

The WPGraphQL Smart Cache WordPress plugin before 2.3.2 allows unauthenticated users to publish arbitrary GraphQL queries and claim aliases without authorization. This flaw lets attackers inject or modify persisted queries that the site’s frontend will later execute. It can lead to data leakage, query tampering, or denial of service.

View analysis